{"type": "bundle", "id": "bundle--683a6324-71aa-407e-b601-824614e7e887", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--092a2882-318b-4d98-a83f-5c85ada64ab2", "name": "DigitalOcean Toronto", "latitude": 43.6547, "longitude": -79.3623, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "CA"}, {"type": "location", "spec_version": "2.1", "id": "location--69ee89b6-ece1-40fe-bb51-734260f1740f", "name": "Reverse Proxy (Perth)", "latitude": -31.9505, "longitude": 115.8605, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--5f547bbd-bad6-4030-b7c9-99a6144fdd47", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--7cda1237-c58c-4edd-b015-436b85df8aa2", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--428ea2db-62e7-496f-b742-68083abb966b", "name": "DigitalOcean Toronto", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e07b6b9e-dbac-44a1-9603-06671e58007b", "relationship_type": "located-at", "source_ref": "infrastructure--428ea2db-62e7-496f-b742-68083abb966b", "target_ref": "location--092a2882-318b-4d98-a83f-5c85ada64ab2", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--1310ab91-d364-454e-8f0e-7496bd821726", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--43ed2604-f93b-4fa2-ae76-0f25998de74f", "name": "Reverse Proxy (Perth)", "infrastructure_types": ["firewall"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ea2b3dcb-6be9-4b6e-85d0-1b5ec240f1c2", "relationship_type": "located-at", "source_ref": "infrastructure--43ed2604-f93b-4fa2-ae76-0f25998de74f", "target_ref": "location--69ee89b6-ece1-40fe-bb51-734260f1740f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--70c82ce3-dc30-4a35-8785-e2ea67fed5a9", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7ba01a46-aa9f-47de-b104-e225d8f0da4e", "relationship_type": "located-at", "source_ref": "infrastructure--70c82ce3-dc30-4a35-8785-e2ea67fed5a9", "target_ref": "location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--01321170-de15-46eb-86fa-805fa14f0f1d", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eba9cd58-e651-4d7b-b73f-97dda0b125bb", "relationship_type": "located-at", "source_ref": "infrastructure--01321170-de15-46eb-86fa-805fa14f0f1d", "target_ref": "location--5f547bbd-bad6-4030-b7c9-99a6144fdd47", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "name": "CVE-2002-1149", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "name": "CVE-2021-21985", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "name": "CVE-2021-22005", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--7705553e-f518-4886-8316-dbeeb232287d", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c685ada0-ee6a-495f-9f2e-2096472a3bff", "name": "CVE-2021-34473", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--6fda95d0-3ea1-4143-8227-d6cc30570c4d", "name": "CVE-2022-22274", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "name": "CVE-2022-22947", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--493e25fc-5c3d-4474-b68f-89943481b076", "name": "CVE-2023-0656", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "name": "Network Service Scanning", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046/", "external_id": "T1046"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "name": "Exploit Public-Facing Application", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190/", "external_id": "T1190"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "name": "Credentials in Files", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001/", "external_id": "T1552.001"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "name": "Cloud Instance Metadata API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/005/", "external_id": "T1552.005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51a645da-d72f-4388-9126-ca7c0ec56237", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.13.158.23']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6fe13c3-f8b7-4f98-ae6e-6c592e58076d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.208.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ba71fb-2a4c-47a5-aa4d-4792c301dbc8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.33.66.34']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7157617-7137-48ae-a906-fc828a1dd072", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.33.80.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f46a10-06be-432e-a486-526a189ecf0d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.116.232']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16a90444-1867-405d-932a-e3e69477548b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.26.199']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a1a1e01-b2e4-45ad-88d6-ce5ed7b1d219", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.141.41.194']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2631beb8-1a95-417f-8836-e80798eea332", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.180.60.149']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff18443a-125e-415d-8967-d9c75ef9abe6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.66.147.237']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e57f3658-cd4a-450d-aa84-9f1b885512c7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.66.183.29']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da37f661-bc31-43dc-a627-70130270c414", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.68.77.123']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3863cb7b-434a-4a42-876d-07f310738c87", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.132.236.30']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af223f3c-9fa0-4897-b40f-20479ad864f3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.134.227.182']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a07dbad-96eb-46d7-904f-b2228add5ebf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.151.75.25']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5004ff9f-46b7-4c6d-87dd-dceb62957202", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.152.101.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--822e830a-9008-434b-bd3c-e509180ac19f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.157.149.14']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a11a022a-75a7-4bbc-809e-2d1148938ea8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.183.62.0']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ea2e56-b9e4-4b54-8da2-78e852be10ac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.183.62.1']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e216bf90-430a-45b6-9a3e-d0a236747095", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.183.62.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9109c39e-9099-4495-b049-fd9331eea615", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.183.62.3']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cf18d1-1a5d-4605-81eb-206899be948d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.77.87']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d5840c7-c288-4f78-b2a7-b7b942e95ca4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.19.130.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70c77c37-ab20-4f15-ae07-125cbfb9966e", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.233.24.205']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30cfa224-b942-427e-b135-b27dd096cbd2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.235.198.33']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a9f9b0-f8cc-4d0e-aae6-3437b9f1dfc4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.26.86.27']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a84a8d2-80e8-460e-bcb5-b9a978346373", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.250.108']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a835d45-3768-4599-9508-b4b70b02b6d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.250.236']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c443def-cbaf-438a-be27-ecdc99f4fe71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.251.198']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3194a6da-3b58-4812-a8b1-14918bcf737d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.69.96.120']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85c9674c-7565-4d69-82e0-59baeefe59c2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.82.21.8']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5b88698-3e74-4e47-9681-1c67137be68c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.97.160.118']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eec236b-8c75-4d1b-b5c1-a27df9437ffc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.98.176.164']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ac1fa2-fced-4aab-8ff8-43a4efe8f3c2", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.9.27']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--783040ef-8c03-4922-95b7-9e0d3a1cb0a2", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.88.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a08259b-002b-40f2-903c-2cb70567d5d7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.168.93.75']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3e1ae14-1632-4a1a-b04f-e6cd4454507c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.208.108.166']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c777cff-2f17-4d17-ba29-9de0d9d726b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.121.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12d3fb82-9e08-41bf-8b5c-f731106f818e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.225.76.21']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--840421d0-0e7f-49c1-944d-e1b7f97e0bcf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.117.183.88']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b6c5270-ae4b-4935-a1b7-c3f050c01d44", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.120.240.183']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c05dd56-9f84-46a4-b5f2-3b8e778d36f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.52.171.40']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b5d6bc-c234-41a3-a517-fe8e06ba2eb5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.55.254.60']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db05bb2-cc99-4f28-a25c-b0caa746f7a4", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.241.127']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bf20a9c-0b57-4a93-95cf-c67e1349cc44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.175.212.202']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cec8b4-1a4b-42a1-924d-5933e9979fd6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.175.88.250']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e40d887-5dc6-47e1-b8bc-afd01b086511", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.178.17.26']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8e00bd-b049-443a-8faa-8e9ea419bd91", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.108.91.38']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b1139a6-ff14-4dde-8504-6b68cec1640c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.121.166.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c4f730-b58a-4c29-b55a-7ff18fd46c3d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.205.211.73']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95fa9599-6cc1-44dd-8a46-c588d61bf6b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.70.100.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0205b77e-1490-43b3-81c6-89ed162a645d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.229.147.69']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfe478e6-0f26-48d6-b776-0f196923d733", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.249.201.147']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cfac35d-04e5-4d80-99be-62d0e304aba4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.38.2.131']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb9d56a-e8ca-48b6-9e29-c0907e7f541c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.225.207.226']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b68a6eea-963f-47cd-bdd2-2cccbb40e342", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.230.233.46']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22cb9b41-3fd5-4006-91dd-dd0a004fb6a4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.251.4.21']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbc221ca-c377-4479-8e4c-1a7f81dafcbb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.42.253.130']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1bae2cd-a323-4eae-aa90-d0538ffc3fe9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.63.191.252']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea69c05-8c41-4cd5-b9fd-02b8dac83ec2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.92.157.221']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7904a2a8-227d-4bd6-9c8e-8ca1a4b9f154", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.92.157.235']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05032dc6-3ee4-4c74-b4f8-df7794428484", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.124.57.213']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c5e174-c8ca-4f18-b632-f3bd3215430b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.158.200.53']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ba6a59-e50a-4d6c-9790-c5a1ab8dcfe5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.185.230.208']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49873cb0-1c56-46f9-a37d-44f9eba6565c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.38.68.82']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189c9916-96e5-4c10-aacf-e94d133562f9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.42.26.167']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50690b1c-4b04-47a7-a820-22a371531efc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.8.142.106']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9881531b-20aa-4bf9-b5d6-c8099c79b6d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.166']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f1eedf9-3b6f-44ee-929b-8960cd99df80", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.66']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40401d2e-4e3f-48bc-b262-a9382e12dfcd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.31.180.18']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c0c3694-247d-4547-88dd-6235ea4a239f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.130.13']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16481229-290d-4aba-9fd2-6b986eb5c37a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.130.29']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c9e58a-ba44-4535-8e88-ecd27cdfdc82", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.146']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d481c114-32bc-430a-9843-9336f5de1fed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.253']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51121527-f359-4ed9-9ab4-c93f1872b64f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.98']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5094e74-36e4-4734-8e5a-a0261d0c1486", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.134.110']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af5b1ccb-a2ab-4c48-bb15-0fa2136aa04d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.135.143']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--592bb99d-fdf0-4f9e-8b6b-6e38080c288a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--017d27bd-d31a-443d-9a2b-4ea0c9a0411e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f15cc3-25b8-45bc-b779-a823525478d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.64']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d112eec7-a9b5-4fdc-ba2d-31f8ca9f291a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.8']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064ee60a-03a7-4fe4-b797-d5899be203aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.138.117']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18d90d7-1307-41a0-92d6-9ee6896b437e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.133']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2255412e-cc15-45be-a9b9-671a4c9cdc54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.43']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2830eae-31d1-46d1-9e0a-5b4d65722f01", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--427ee8ef-0f45-489a-b4f2-499c6cf07a11", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.250']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1633aba-dbc9-48fb-b615-322e4eee36f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.47']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a59581-ff6c-488b-aa34-dfd4d660738e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7480d2-082f-4227-8e06-070facbc2ee5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18fc8679-ff95-4efd-aebe-fcc79233bbc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c748a2b2-3d51-40d5-b311-197fec4eba85", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.143.174']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ee26913-8a96-46cf-96db-58c1ffbb911c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.144.85']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0607b022-0afb-4b3e-8d38-d900cecf3d13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.148.184']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b937791-d48f-4d35-8a8f-82799c94eb9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.148.252']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bac0c25a-af2f-4624-ba37-15fb7da64a86", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.1']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6daa7c8b-722d-4f1b-9749-d1f8233a9d71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8361621-1b89-49cf-a114-ef26599d1ddd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef579ff5-b788-4114-80c9-350468587006", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b65a0cb-95b4-4a78-904d-209aa3ac9ad3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93545637-03f5-4d8e-9116-7058200a8768", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.91']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091d0c40-24b8-4f78-ab64-79109924ecb0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d74712-4570-463c-ac77-c3591526d7c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06d0793f-e598-4c2a-a06c-42e674ead770", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25d5fc31-f6ee-4218-9f97-4cd9a6732063", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.163.186']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8bb9372-bcef-4bfc-b18b-eb18455b4440", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.55.111']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9d3ebf3-d4f7-4359-a117-c9fe39a2d5bb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.187.45.20']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f7adf5-c8f7-4b1b-a406-9a20d80335f3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.88.48.171']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ecfdd57-c575-4708-ad8f-b83a690fd70b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.14.224']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75810cbe-65e9-44fa-9e5a-115e13e73944", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.135.48.60']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed26404d-fdf7-4ff1-98b5-0f5cd28f9514", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.199']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a483aa2-5707-4057-971d-1f63598ba6e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.97']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--808569ca-1774-484d-8a32-835fb1cf7e89", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.30.14.132']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab6a0e2c-2df1-40ea-82a2-1b2d0e2f60e5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.44.232.40']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--854985bb-6428-4272-953b-b978b3988c1b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.99.172.41']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7699c8e-bf4f-4b81-be4e-b49ccdbd27aa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.99.174.196']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--004bbef6-d6c5-43fc-ae7c-0bf53b265841", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.152.144.85']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f355b202-eec5-450a-9b5e-ed84b5222255", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.155.232.208']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5df2a02c-074f-46c0-a7b6-6a8d7429f2a1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.155.248.250']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f92f81ba-42bc-424d-9fed-e575f7ae102d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.169.196.101']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37a9cbc2-1a98-4238-b2f5-fc306985bc5a", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.61.179']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a029c972-daaf-49ab-8b82-c9ec659cf1ca", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.119.56.1']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b295c789-e957-4939-b930-c4363eaa2c09", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.181.23.162']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16d99856-7233-4123-95cd-396f6fc93987", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.186.100.29']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3909260-231e-46fe-878d-c4ac16f1b68f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.41.86']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--957c9ada-0512-420f-b353-920444506630", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.91.20.139']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b35cad1-238e-42a7-82b7-d4fa86985bf3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.1.93.39']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e90a303e-3187-4a29-bab5-3c6cce14bddd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.203.130.226']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c84081be-8098-44cc-ba88-348307ed3b14", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.219.76.212']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9d88e5d-b768-4773-970c-4948cf086693", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.225.54.106']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8441ce37-27b8-46d5-bc3b-c71e22ea8dd2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.229.172.152']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc96be05-33ab-4d71-aa9e-2990e360633d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.241.135.198']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ad6e7d5-7941-4020-8835-fecbc8f964db", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.243.32.52']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abcb63c9-83b1-4e94-bdbe-30c2ea23d642", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.60.44']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c28de4da-0638-4a66-92d0-83eb7e74d3f4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.137.29.114']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56067b16-a001-470d-b54b-6daf51c8d243", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.196.196.104']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2aef9b6-dac3-418e-9eec-38a57fd1508c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.41.164.68']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1657ce9-94f9-47bb-8e3a-f34aa1d04bc9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.12.89.139']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54324154-91cf-42c4-be09-0fcb561c73c5", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.138.18.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaba6b6b-aa0c-43ec-bf85-0a656a78dfab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.176.4.145']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--390e69eb-e1c3-43a4-9c29-aa02e6f4ef8c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.207.65.62']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00bb57fc-1493-43c8-a1e0-971528d35a18", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.209.112']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cffe00d-ff41-4c4d-a039-e47ea0d7403b", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.249.106']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fbbc3a1-5546-4215-be2d-cf3d4e047f6e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.163.54.254']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984f4832-88b9-4f3d-b3ba-9f021ddb3797", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.103.155']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a589a08f-9cb3-46e5-b7d3-809fbc4c3666", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.146.188.65']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba5ef5bb-2679-44dc-8e11-e0f72098f000", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.15']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65923a65-5ebf-4da6-95e0-ebb365304ea3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.39']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c6e22a-9dfc-4c47-967a-ced5c5b782f8", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.77']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--297a2570-6283-4fbd-a108-a820cdba8002", "relationship_type": "indicates", "source_ref": "indicator--c4c6e22a-9dfc-4c47-967a-ced5c5b782f8", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af5af0ab-8ed4-4d72-9673-13dc77a24408", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.182.107']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3241520-4b0f-4735-989d-484a52f622d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.182.254']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b25bef2b-55a8-4ea3-9c02-4ebd28ca5687", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.148.142.253']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bc9eb02-b6e5-49ef-a23e-0aee218313a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.119.169.31']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef2caf4-eb62-4dd9-b7fc-208a86f9dea1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.15.185']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c40870b-6395-42e5-9a70-f828443dbf35", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.204.26.251']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff666a88-0e75-461e-90e1-cc37b6e622dc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.246.253.24']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321778e0-4a37-4ce3-97cf-ce0b7c6ccdce", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.36.148.31']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6a2714c-0746-4e59-94bb-9c4cc83e1cff", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.42.227']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf5545b6-5c5e-4917-aa71-9bb061060082", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.19.117.130']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f905f9e-23b8-4fff-baeb-e3723a4f2e77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.28.219.68']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c32eedca-df78-4a36-b6ef-376142b6bec8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.116.87']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afc37e95-14c7-4d8c-a55a-b78bc1177fb0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.177.234.46']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a14a3f13-38eb-4c1e-b503-27ecc45907a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.178.119.23']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bdf5d65-dd01-46a0-bb2a-85de2b252d0f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.225.206.187']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac828e66-9fc8-4345-be77-7921d8a8951a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.96.237.189']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e81a5ec5-b17b-4470-8c2a-8353900b2c7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.175.138']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c4b1cc-3870-4b91-bb61-15a93294fb93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.57.84']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1b4530a-eae9-4138-b680-4b3755dc7430", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.92.74.163']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abb54623-cc9a-40cf-b1c1-30de502670f5", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.172.111.126']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ba8951-e9d9-4d38-95d5-bb654044e113", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.59.169']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e055f216-5463-4da9-8c52-bc669d273aae", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.241.126']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd7c7838-736b-4189-9271-85282aae0463", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.241.142']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ebdf27b-367a-4976-ba61-f4ccf270b95c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.241.92']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a006cad-a0ad-4684-a0a2-94fdaf26b512", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.202.179']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf10526-628a-4959-af5f-5e248c9651e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.114']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a4a5258-2fbe-4da0-b868-893f24ba08fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.118']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c69d5d42-304b-4c00-9569-f5f5b51b828a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.240']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d23f2952-9e68-4df2-901d-2ff3de625173", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.249']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa083b09-32ba-4a03-8e40-19391afbafef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.28']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17349ce2-ce07-4e88-b5ac-dd8126d74ab8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--392a63e9-c3be-4f04-a183-2fc2276fbc16", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.61']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9acc415e-341c-44e2-8188-32232993b770", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.76']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ad7042a-bd33-4a8c-b553-e7390db5bbfe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.45.211.139']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d10bbf1-0ded-400f-85bf-3fff0b35f6f7", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.50.107.54']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0983e42b-410e-44e9-8922-00c063966707", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.46.88']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e8296e-bf7d-4937-969d-c97123dc58f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.64']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fcb1766-8ca0-4a8b-b9ef-c8a68aacccbb", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '151.240.205.249']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cde433-981e-4a60-abc8-05a6d5a5bf48", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.163.86.26']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20b96bb6-0744-4b1a-8c3a-5bc9487c35ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.228.236.214']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a3eecd5-e4a7-42da-836c-f8f78ba56452", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.254.175.216']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--388b3a14-7b2f-4f68-ad9a-747f0bb00db7", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.138.230']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14ca714-b62c-4df8-8147-8e439bb900d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.223.81']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1829eae-be33-4e09-8d16-82dbb8907311", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.66.28.132']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb6e6ca4-cf14-4071-8b60-546816514a77", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.30.110.188']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e933b770-bdf0-4664-8da4-2075ea21f78b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.47.29.235']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7cc9702-7e58-4118-b5f2-06c2cb1a45ac", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.64.12.252']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb55f79f-028a-455e-8452-c9b68cbd42fb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.233.240']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a00d735-bca7-4800-9934-efd8167e987a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.243.87']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7cde0a9-6758-40b2-ac1a-b4dad7d3d7b4", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.4.122']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c01ffd54-5275-43ea-a288-cf9f58ca30da", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.97.124.233']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee1b6d4-f6e1-4a8f-8def-03231f52bf9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.158.74.177']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5320219f-e620-488c-bac3-5f0b9c1168f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.173.101.4']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37cd7bc6-9e00-4d72-bdd7-48f5ed912fc0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.130.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f63a246-1fb3-458a-a824-3ad5d909012c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.14']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4615e02c-ee94-45d1-8e0f-0e293a48acac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.14.109.170']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e93c34a3-bfef-464b-a796-b80fedb51095", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.217.103.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26f13396-14ae-4c66-8467-142a76f0e9ad", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.1.156']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9b9ee9d-ac1b-4c1c-ae83-8c710f7a55b7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.15.64']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbd1aa50-fae4-4cd9-9c08-db0817e56e83", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.9.55']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e2cf80c-42d4-4adc-a056-de1ec204766a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.132.240.169']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--024fcf48-e7a9-4cda-a29f-74171fc5c25f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.109.155']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44e0ed7b-6be3-41ce-91c9-dd0bd9be866d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.232.165']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dfde9e8-3f2c-4578-bd40-33764370115d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.71']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b844dda3-1f62-40c8-8632-b7a99eaab91a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.41.116']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c46c01d0-0a6d-4291-8b71-34f4f92149b5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.249.25.237']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b944cc-cba8-4c49-93f4-6b6308b61b0d", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.174.121']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e0524e8-f9e8-4465-aad7-53e901c1cd46", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '169.150.201.134']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c014bcd-1c7f-4901-a84f-eb59c57b0a90", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.58.129.25']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3b7f575-25a1-4e90-80c3-34ecfbd0e9cc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.58.137.184']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fdbfea7-303f-4720-bcb5-ec135a4321d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.22.237.123']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d6df261-6f88-422c-a80f-6a02eebb0931", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.241.227.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf23346-bca5-4364-b1a6-2d47df56ee0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.192.205']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--535e61ca-c2ae-4e92-a5ff-0375881cfc82", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.147.115']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aadf6cbd-ec09-40f7-a8cf-006fa1a27620", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.11.73.68']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e661d2fb-efeb-46dc-82e4-d4074dcd7bbf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.213.249.226']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a98de438-08f4-4347-b863-5a22509acaf4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.127']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1fe983d-a5b3-4f91-bb9c-1e0d2d67cfec", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.134']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f983b1-02c0-4dd0-b68a-e0335550422d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.150']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--333044c5-e986-4f1f-8ef1-0df3fac2a88f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.164']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--270c456b-a659-43a3-94c4-7b702ac6a7f2", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.193']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4220d137-d6d9-41ee-8c6c-45e48807c2fc", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.34']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60905cac-a115-45dc-8d92-20499843eef8", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.79']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d5972ef-2bb3-4530-a5d2-95084bcda1fd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.238.50.201']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a259e4f-1c61-4035-a66c-9d81127848a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.46.91.184']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86dcf743-7ca1-4b3b-88a2-67092bd27763", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.54.68.205']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2f846a-98f6-4519-8a16-5546643cc66c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.100.48.132']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--906004cd-af26-4a63-b5ce-093e2094eade", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.228.60']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d429a5b7-7929-4c40-a269-dda6512bb4ee", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.52.101.238']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b419a96-3d87-4fa8-9c31-51f003a9f593", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.67.17.158']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02c17991-3964-4662-8110-0aa226140436", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.138.20.55']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5076e75b-e492-4cc3-b884-57709fd6e496", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.6.239.207']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57df2756-9a97-47b1-a206-374ac12a52f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.91.75.252']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f14ab6d-ee6f-4d08-9ba2-7c9a0a105beb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.141.130.127']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c23ca80-de49-44eb-af45-137e4de5b8c3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.150.175.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8890ee20-06ee-41f4-bad7-aa85c484c4e4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.159.111.78']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ac3747c-d187-4f8a-b555-723437e6081e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.74.120.72']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b80304-b358-4f99-ac25-b5a206e517ec", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.225.184.143']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--937eb0c9-57a4-45be-b3f9-3ca510f8b502", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.210.3']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6bdd7a3-10df-4e7f-b21b-629ae97cc5a4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.167.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69ee093-76d6-4de9-a8a3-453ecd1e1e93", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.116.101.220']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a52e7b31-e4d6-417e-acdd-554df5144c78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.163.29.219']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f44ecd93-07c2-479c-8f8f-9166d466b99b", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.166.193.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18cac9f3-02d9-486d-bd26-410bb02dc43a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.173.122.148']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--538a60dd-c09e-4ca4-af98-701f011e0e0b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.235.119.228']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cfedd26-2a2d-454f-a65d-f2e865d054fd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.242.59.217']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d74db75-38ce-4d14-ab00-b435ef168822", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.164.12.188']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3688941e-ffed-4a8e-a54c-be489f033a4a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.218.172.74']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f06c30ea-6513-4f57-bfcd-3e8cdace1959", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.225.32.49']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59046ab2-19de-437e-9aa9-b468aea33a86", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.45.135.175']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea193d0-a566-45a3-9175-466453626e1f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.46.71.228']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33c9be58-4a9d-4893-bc9c-20ea19335255", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.62.56.9']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bb09026-f224-4f4d-afb3-f5e74a545fd6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.94.229.11']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--467896f3-5801-46f1-b80a-4201e84eb293", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.123.144.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--699b82eb-ef7c-448d-b865-a44a59dafe07", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.127.69.34']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87ca9f5-ed2f-453e-a0cd-2202c8cccdbb", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.40.103.253']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca75cb9-7969-45ee-8c1c-5508e3959533", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.165.124.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f42d4bf-ee35-4b7c-9211-294c13d87f5f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.197.85.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17ddc5c-2b38-4b5c-a5b1-5d38b3a8e67e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.198.255.158']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1867ad4-2a91-45c2-bd21-156c7ccef651", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.88.232.183']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33a3fd99-c4e1-4044-8c79-902629a72609", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.186.36']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21be5903-57d1-4828-b49d-d459110fd573", "name": "Malicious Host", "description": "Observed: MYSQL, REDIS activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.107.106.86']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:mysql", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054a4aa5-78d0-4f9d-9814-0414efc6db26", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.112.148.66']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d4f4fd-b8a1-48d1-ab4a-f95839c4d2f0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.129.61.129']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00ce5022-4520-4c70-a355-f90864abfa69", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.16.38.132']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82864ff5-79e1-4d0a-aa6d-6975325e8f1c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96092b32-e593-4ffe-ac00-e60b4c320cf2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2cefd01-eba7-484b-bd09-1f453b8b2683", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2c0f85b-9e87-4c7a-a3e2-2c35dd9d8e30", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5394959-2a24-42f5-861f-0aaf9282a32e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce5d2fd-929a-4605-af88-c88db154542c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb9c6753-a937-4fac-8b2e-ccf1956c339f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812649c4-bd06-476f-bad1-5f7e54494109", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4803ffd-1323-44b5-b965-f75dcd00c5bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c612e1-c361-415c-9401-22d7895f6879", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f353998f-d364-4142-aa2f-0e5d0843e972", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb53644-2bb7-491e-9886-a43961d9d751", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d48d4a5c-941c-4d45-95df-255c3398e268", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40fe120e-5435-440e-8688-5a582ee95ac5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc278838-ee0f-4aa8-90b8-5288c2fcd02e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64954978-278f-462e-b0c0-6be7dfc9f179", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6545b4b-7221-4be1-bfe7-740231be9250", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31960f4c-f00b-4c70-952c-73d4261f12c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99951803-d967-4fd4-bea7-94f9e26903cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f194416-ebbc-4c31-83a7-851aaaff9749", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.217.188.132']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27dd8f7f-d86b-43cf-ae3b-d4cca0319509", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.220.101.156']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dbb9bbb-48e3-4c0c-8245-68fe4571e596", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.220.101.26']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--604b5c28-d589-4592-8072-2fe2ddb79255", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bd5b6b0-991b-47e8-9ae2-18727958c9a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.241.208.95']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10b9b665-8a65-49fc-9b8d-6321b6c9dffc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.229']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c3cefd6-c2ad-4bf2-bd70-18f895c74a8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.246.130.20']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5585029-a4cc-4bb8-89f7-07d16ad88c49", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.214']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a37abbc-c7b4-4b4b-a55e-062d0d8a91a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.119.230.40']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a722e6b-1603-4fae-96ea-22cc2e163b15", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.122.212.144']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a4bdb1f-2645-49db-8df4-b3855e833adf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.123.136.120']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c048d16-a1c3-4196-b08d-f3186e4dc984", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.154.144.166']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a130c37f-f926-439d-ac4b-c4910c9d0c39", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.211.96.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97773d75-14d4-42d7-ae52-daa46b596072", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.84.70.44']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9c1ebf6-9918-4cab-afe3-4187b43a6f3f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.86.177.29']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac248aa1-7fc6-4680-a6f1-303f0eb14205", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.130.189.138']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b1d363-de23-4837-a4c4-6a333551fc22", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.90.38.164']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd2fc1a-fc77-4d45-993d-7df2b1c814f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.237.254.161']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fc4797-5942-4be1-868f-aa5dd86982ce", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.141.253.56']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--724f8a5a-707f-4b49-95e0-0bf310b196f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.71.10.31']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f9c2ea4-8254-4930-978f-ce1705c199ff", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.253']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e8ca32b-debd-49a5-b47e-f053aca5bd69", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.200']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8e7784e-d2e3-4c5a-bce7-d267df8d3bc1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.187.100.99']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4320152c-00c1-4fd5-8384-6a2e120c144d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2616f5c2-8cfb-4618-8cd1-00733b8344c0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.84']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11c2ef0f-2a0b-438f-96ae-a450f0784736", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.36.224.160']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3973731e-041e-4726-83f2-a321611482c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f4d98f-40cf-445d-b143-253456991c53", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.44.111.186']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22a7e53e-a3f5-4bcf-bef4-2be4a02d3a46", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.51.234']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c5b8f36-42c3-4952-b31a-2b5a93aac7a1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.68.113.83']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eead6b69-f317-4507-bbd2-57e1f60f749f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.137']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9839972-b6d9-4185-b1e5-91cfa4218e24", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.199']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--266c8ebf-9c1a-4c6b-9a33-9358af7032da", "relationship_type": "indicates", "source_ref": "indicator--b9839972-b6d9-4185-b1e5-91cfa4218e24", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0044cf50-92a3-4489-9f43-9c7aea38ab82", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.211']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0ab421-43d1-41e6-a07f-6a9a28a63bc9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.227']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c9a0252-c1a1-4c29-80cd-da5bccc56421", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.26']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf6ee32-ae56-4886-878c-42ae915fe607", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.211.187.240']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8481c46f-93ab-44df-85a2-b117e33ac169", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.93.244.97']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf36118-be0f-431d-b2de-fed5d7ab8497", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.138.107']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e545a26a-93ca-47c8-aefd-7f8fa66cb01f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.138.129']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--740a8c29-f2d3-4bb2-8b5e-280a8e3f0839", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.170.81.254']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ceea4c-c9c1-4b16-a9d5-a1eb83e5e268", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.40.117.170']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce53dc50-11d7-44d3-b729-39c6b3747d98", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.234.52.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3dfef1-6466-4dea-acd8-5b743c83cf99", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.107']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea271bc-e51c-4b45-b695-b88ba7d38250", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.11']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5cd4fc1-87bf-4e6f-b7be-994fe7a32ba2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.153']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d28ac2f-bc0a-4a7a-862d-3dd523358ba7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.162']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0b0274-1d28-4202-8292-a5454baef96c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.186']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e3a7302-8770-4d5f-8574-5164dea87921", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.232']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0193842-78e6-4489-86d7-c1956862af6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.254']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--922d296d-f625-46b4-a2d9-976562a1088b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62065d3e-018c-4c19-b276-ff53aa5ef3e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.54']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a190b905-c340-4e12-b358-fdd5341bd3fb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.65']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ba45e3-dfd1-44d0-a641-b8668e18c595", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.66']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f01e66f8-05ea-4617-a150-bdf79dfe8cf1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.87']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827f32a3-1ef7-44c9-a346-8cba2d71b72e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.180']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5246d6ec-40e4-453c-be93-6a4d8e42a300", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.60']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67fe9f14-6a4c-4688-8671-9809bd071163", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4494a5d1-4a1f-49f3-8189-44a9ffed53e1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.120']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b793bccb-df43-47ec-8e43-9cc4516f04a2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7c447e3-af9d-4564-ab01-e2ab4535392d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.209']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4079266e-1e7d-440a-8ba0-43f7ef3ed43a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91da1293-112b-4d57-a519-000042d19af9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.100.169.31']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae0fbe1d-2132-4e0e-9994-e9f5aefa159b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.100.185.105']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44eda4e7-4571-4c37-b054-efe1ba432235", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.102.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7569bc-18bb-46fd-8744-01a9adce5e96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.116.17.175']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b85cc5f-ac02-4ba3-9f6b-c89f36b59a6a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.13.164.162']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d56165ca-cd8c-43f1-bf42-988801f5e970", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.151.168.176']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54cfeed5-dd6d-474f-9830-f2a53f4f9f17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.203.138.185']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ab8a5d-cdcb-4749-8dc5-fc758809f5df", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.250.10.77']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d04b1f5b-9f30-4bee-9d64-9699636600dd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.250.13.23']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1b5b98d-8ca7-499c-952d-a1b424ef2446", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.105.233']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc97a9e4-106c-47f0-bec5-dd596103f697", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.7.73.61']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de3afb64-8d5c-4e50-b16d-7db8f423ede5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.79.222.117']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5927a9c2-1f16-4582-95bc-97f7b6ae18ca", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.183.91.100']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a135f5-4f79-48c2-b138-e45e6304530f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.76.120.30']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40027931-19a5-4a28-a3a4-a09fd1472642", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.10.44.34']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a39ddf1-afb9-4fe3-b02a-54da0be995f9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.101.144.44']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84842a1-6278-44ae-9218-a73d147fe5bf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.158.50.118']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--302f2511-267e-41e2-accf-b0c43cc9da9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.170.91.69']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--492226d0-0785-49fc-a792-8bf3281152a2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.224']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b3cedb-ba17-49d0-b11a-930794db91a8", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.73']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c3ef66d-a78d-4b07-87d2-d367eea54060", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.81']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23bd824-72c6-4932-9d41-87e595bc7898", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.186.144.66']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--401af01f-897d-401f-a14b-6f0ac60db301", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2172f6c6-6580-4386-9f79-ac4b5f7c4b33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.15']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdfa6f99-ab1e-48a5-84fe-4f82944d76a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.173']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08706cb1-650e-4236-9e90-e0f6a2b530ab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.178']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86dde5fd-5a77-4f9e-a3d5-9c89751161de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.184']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e51639a-19ec-4907-ac06-0decabdd19c6", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.196']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6fe6265-6c3e-4b2d-a2a1-c6ee21a6d6a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.197']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdcaf870-6baf-43df-a0d1-7d72311c0728", "name": "Malicious Host", "description": "Observed: REDIS, WEB activity. Sensors: cfglobal, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.216']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:digitaloceantoronto", "protocol:redis", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e12bcec-5c2c-4951-bca0-9a1f9a4d79c9", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.219']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01cf12fa-8239-4aac-b13d-0ce887ef3614", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.231']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--857b1d0c-219e-4464-a9f7-5f3bb519026b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.250']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eb6bdb4-0406-44fb-ab84-59c3464d2a9f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.44']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb3758c8-2376-49c2-abe4-f6fcff2a9b32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.50']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--592d09be-16d1-4a5c-8bb9-c414233dc9b7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.69']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec56938f-3c2b-4e34-b688-dad591439b09", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.76']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb85acca-e023-4337-a118-247e2f78cda1", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.84']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4568a56-828c-4ede-8f4a-19d44dbe92f3", "name": "Malicious Host", "description": "Observed: FTP, MYSQL activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.143.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:ftp", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6df30506-aaf2-449b-91b6-b316eaf2809d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.217.79']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11025c08-5d35-4643-9b5d-0ca280ebac8d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.34.149.169']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cd7c6da-bbd4-4aa4-bc4e-843e6f3e7509", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c57240-ce3d-4fdc-bcbc-0211f02bcdeb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.79.142.230']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1fcebab-f26a-4cdf-9ac8-d47be35ab185", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.240.117.75']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d6e251-ccf8-455e-8430-1af75a5eb3f8", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.83.176.122']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26b0d164-0802-4bcb-b7d6-c74f37ff8d5a", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.115']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.154']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c0e92bf-38e9-448b-abdf-16526e5e9e65", "relationship_type": "indicates", "source_ref": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8ec04b73-802b-4a91-9343-e061b6c7b770", "relationship_type": "indicates", "source_ref": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ab3f0c8b-f612-48c9-bef2-5a6185087566", "relationship_type": "indicates", "source_ref": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aafcbf48-51b1-4314-b4da-0d57473d3b05", "relationship_type": "indicates", "source_ref": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "target_ref": "vulnerability--6fda95d0-3ea1-4143-8227-d6cc30570c4d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e39d1dd0-92d4-4e0a-8f5f-d9a551167234", "relationship_type": "indicates", "source_ref": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "target_ref": "vulnerability--493e25fc-5c3d-4474-b68f-89943481b076", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d5f6592-b749-4052-b07e-616159074f10", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.78.160']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd140337-8634-4e8f-8667-66e832be8376", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.126.224.237']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55545ad2-a967-4281-a19a-9ae776bc9f94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.105']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a195c7-589a-41c4-bdec-7f92501e4e9c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.202']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f121f310-79d8-4dbe-8022-40d810dcf589", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.156.66.57']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4d1ab55-7418-4227-9f0d-d41e9977334a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.217.253.123']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a984f8fc-4453-4a25-84c8-cf71df7f8708", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.93.197.74']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba564948-8902-49d3-83da-0b6b67f4e985", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.155.82.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74c34f74-14b9-4cf4-a772-ece15d554b69", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.1.163']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--077b5bd3-a27d-4f56-a2fe-c39442c61300", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.202.25.60']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9c0a34e-09bd-43d8-850b-157ef91d8573", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.252.124.230']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f05040e3-54ca-4012-9430-2fed23a5563e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.123.124.183']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--725ee357-732c-4ce9-b7b7-4e1c6dad3b0e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.123.35.173']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d164c8-9b6c-45de-a788-0ac180211115", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.199.168.189']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a630703-79ff-418f-8028-168009fdb49e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.225.110.231']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c71db7fb-4741-45ea-8c0f-6f21c3da4863", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.128.248.166']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4f53709-e4ef-4623-acd6-d27898ad5a36", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.234.72.38']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c221b732-a538-4532-87fa-21ba3637540a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.29.118.224']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a2ce36-8470-4b91-b6d7-3b27780c85b7", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.99.182']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa0a558-15ff-4a07-88ec-3189760a3057", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.188.235.205']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f8fc85-f5d1-4dd8-b10a-a3151b4970bd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.41.130']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f05e176-c0ce-4ca7-bcd5-32bba84c5ab8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.42.155']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b24e536-e66b-453a-bf43-8266d9907828", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.216.13.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3a444c9-51d1-466c-81ec-da07f3f069bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.80.35.170']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87529c79-eb8f-42eb-b302-9cd9f8ace564", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.128.167.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3e57821-95db-4d38-b1aa-3e4b445af29c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.130.11.140']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d29567-1d9f-46d8-8ed0-cde37c211c24", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.134.107.229']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f22d1814-9e9f-4866-be7b-b8e7cd8efb02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.156.81.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48c02b65-7586-4d9b-8694-e40370ea177f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.43.61.174']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba5e1747-96b1-4f96-9170-cfe62bbc50c4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.57.184.247']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8420ad6-8ad7-49d0-856c-fecc94c109a7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.59.92.15']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--729881ce-23d9-47d4-9df1-e713d641a324", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.76.28.231']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--241dc9cb-a978-4bbf-a70a-77abb59b662e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.58.119']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.150.145.79']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c9b54e41-e7e3-46b1-bdb3-df0e44331fb6", "relationship_type": "indicates", "source_ref": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf211db7-ab7c-47e5-ac1e-52c8c0a97ecd", "relationship_type": "indicates", "source_ref": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d75c1210-ed16-4d12-82c5-e0b40ee51ecb", "relationship_type": "indicates", "source_ref": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "target_ref": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f628f32-b80a-4ab8-aed8-4163f52391da", "relationship_type": "indicates", "source_ref": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8ef0bf14-86ac-46fe-842f-6482274dc080", "relationship_type": "indicates", "source_ref": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "target_ref": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42919588-762e-4e75-9727-c04fcb3a7019", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.226.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--925f73a3-7cf1-413a-9d98-6bd2ccc17fa0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.182.149.208']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4309eef1-319f-4ef2-acec-4d17651ec24a", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.186.49.210']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fc0ccf3-7eed-4ebc-9e80-9a360856b1e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.204.28.244']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dbcae89-11c3-4dfa-a4f4-361129b4659b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.23.161.109']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f86b517c-58de-45cb-9f5e-dd6c451756b5", "name": "Malicious Host", "description": "Observed: OPENCLAW, WEB activity. Sensors: cfglobal, openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.24.214.119']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:openclawglobal", "protocol:openclaw", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3b0fb6e-2d7d-4734-8587-124be26619b7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.26.12.87']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dcc7750-fe81-4c00-8e0f-ca9a0afcbb88", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.26.231.215']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f22de167-d00c-4804-a9fa-419280b68b95", "relationship_type": "indicates", "source_ref": "indicator--3dcc7750-fe81-4c00-8e0f-ca9a0afcbb88", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a335c040-0ea1-457e-abf6-71a73628acb4", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.199.65']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "name": "Malicious Host", "description": "Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.151.135']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--55fb04ec-d862-44a1-8a45-51f30d9a3eb1", "relationship_type": "indicates", "source_ref": "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--229debea-03eb-4f0c-9efe-e5ad4a64dbd0", "relationship_type": "indicates", "source_ref": "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "target_ref": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e0ff8ec-cd10-4f92-bf7f-4b7fe5a3b5b3", "relationship_type": "indicates", "source_ref": "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ca83cdda-5f19-44b6-add8-d9099fa2c509", "relationship_type": "indicates", "source_ref": "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "target_ref": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17bd7a88-c828-4030-83bc-162cc2ac78df", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.5.44']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c817e4-5689-4421-a3b3-557d70e79e4f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.66.85.241']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.74.253.47']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8adbbdef-feb1-4f9b-9ec0-64991070f55d", "relationship_type": "indicates", "source_ref": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7f65b0e2-ec43-4f38-853b-f28547a6c037", "relationship_type": "indicates", "source_ref": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e0b1a0d-c1ad-4df8-adee-a118c8f2cff0", "relationship_type": "indicates", "source_ref": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "target_ref": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31487b3e-4d84-48d7-befd-58a60845e6c8", "relationship_type": "indicates", "source_ref": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "target_ref": "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8c56f10-b736-4ef2-8fe4-3f41a05c11ea", "relationship_type": "indicates", "source_ref": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "target_ref": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e1016b9-9e9f-42db-ba43-1becc7c6f408", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.113.25']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbecfda7-96cd-4068-ac66-52ac3ecb5d35", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.63.137']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c30aefd1-a1e4-4597-805f-c489aff5394f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.81.146.168']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73f6877-7dfd-4475-a321-34998d27d2d6", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.86.188.226']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f13aa69c-7222-4de7-a4f6-36c4d4575ce8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.192.55.223']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a153a7a8-0209-4bff-b5a8-48bfa4c8e4a2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.18.131']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2f686a2-b6b6-486e-a0d2-dcf109a322e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.67.49']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.221.5.154']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1cb5ecc-b507-4716-8b62-ba5c900b1bd7", "relationship_type": "indicates", "source_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--899e706b-ec6c-40bd-be5b-a9197eec06ef", "relationship_type": "indicates", "source_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33cadbc3-baa0-4ee7-b2d7-fce1bdc658ee", "relationship_type": "indicates", "source_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "target_ref": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--675dd3c1-0be0-4b92-8d48-e16d67b9f897", "relationship_type": "indicates", "source_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4dc7fac-24ae-45a9-8bdc-65f8be67952e", "relationship_type": "indicates", "source_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "target_ref": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f012d293-9e5e-4354-b456-2406e036d976", "name": "Malicious Host", "description": "Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.223.23.88']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e89127e-df84-42e4-bfdf-8e255ef5b124", "relationship_type": "indicates", "source_ref": "indicator--f012d293-9e5e-4354-b456-2406e036d976", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3eff2c5-224e-439c-bbd1-31d00dcd27bc", "relationship_type": "indicates", "source_ref": "indicator--f012d293-9e5e-4354-b456-2406e036d976", "target_ref": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84aeb30f-ef91-49a2-ba58-983be001213a", "relationship_type": "indicates", "source_ref": "indicator--f012d293-9e5e-4354-b456-2406e036d976", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0242dd22-53cf-45ee-90ba-6a6b536d329d", "relationship_type": "indicates", "source_ref": "indicator--f012d293-9e5e-4354-b456-2406e036d976", "target_ref": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0599354f-5ac0-4a79-823f-9a2622205f72", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.31.128']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bbb6038-2af1-4ed8-88e3-1f8555ce1875", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.32.23']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.49.242']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9780554c-8811-4311-8105-d08a0155103f", "relationship_type": "indicates", "source_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--07dec755-c9cd-40b0-93b1-05868d21087c", "relationship_type": "indicates", "source_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5d1c8d4-79e3-4b75-8b83-04cad6e2b2e8", "relationship_type": "indicates", "source_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "target_ref": "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a7e1e3e8-fdc5-4149-b955-fef8ceca6769", "relationship_type": "indicates", "source_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b174b0ef-92b3-4022-9f09-8de8ec012299", "relationship_type": "indicates", "source_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "target_ref": "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a767edf-b470-44b2-b032-5c26243300c0", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.97.242']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50d70d5e-a9f8-4ceb-998f-b89e75088deb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.134.69.15']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5b3a8d-52df-4602-918c-f447cc0bbbf5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.143.42.62']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee8e40b1-4dff-46dc-b558-146f4f2e8122", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.148.90.45']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f2af93-1148-42d9-805e-ac9320e714e0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.158.9.168']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0bdb7e-175a-4bdb-9e66-10bc639519f4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.69.240.238']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c33bcfc-fff3-41c9-ae85-9e3f8fc879fc", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.81.72.106']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a35541f4-0467-4377-8bff-11bf7cfdb455", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.89.252.58']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--909b4c84-80c2-4573-8aba-173ca3a33984", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.194.102.68']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8728bc01-eaeb-43e1-a488-6cc15a22f5b1", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.224.39.30']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--661c5c44-6f89-42fa-8aaf-a52ea7db2be8", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.248.156.118']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de021dda-b388-4cd5-a2ed-32ab88b16587", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.253.147.222']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3118753-e93c-4289-8c29-34d7fd9cbec7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.60.212.27']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7994d73-7aa9-4b60-a452-1c315d510e6e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.107.142.38']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f09ecd30-9a5c-45da-8f68-4d0f4bd576fa", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.67.67.243']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa60d159-003e-486f-97be-d786890c231a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.223.164.152']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad4dbb0-c18c-4bb3-805f-db42abbe8102", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.223.165.84']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067e2167-b656-4fb4-a6c4-eea168f14f8f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.223.171.122']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b80b4b9-0771-49dc-8ed9-e9f20b272f45", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.24.130']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7bbd136c-e18a-4ce3-b8db-6bf68fa35fed", "relationship_type": "indicates", "source_ref": "indicator--1b80b4b9-0771-49dc-8ed9-e9f20b272f45", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--48122c91-aa48-4ac6-8320-5a409777c2b4", "relationship_type": "indicates", "source_ref": "indicator--1b80b4b9-0771-49dc-8ed9-e9f20b272f45", "target_ref": "vulnerability--7705553e-f518-4886-8316-dbeeb232287d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7bb3b870-63af-424e-a483-e75c3d05b722", "relationship_type": "indicates", "source_ref": "indicator--1b80b4b9-0771-49dc-8ed9-e9f20b272f45", "target_ref": "vulnerability--c685ada0-ee6a-495f-9f2e-2096472a3bff", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96d82c7e-8f81-4068-8091-d72116c60063", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.160.62.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f555d81a-0950-4960-8683-88e5178ce1d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.131']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15603be3-d8ec-4e57-a451-84d30331ffaa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.241']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22e084ba-23b5-422e-8b91-4dff775e1f08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.42']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ed6345-85da-4572-bbb5-5f83250e2cb3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.43']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe7aac2-38df-475b-a326-e9c932ba37e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.49']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30147632-3c09-418e-9217-36e0ca73d29c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.6']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5c2da55-53b0-46c9-b93d-f990f94171f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.74']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05dcf205-df78-4989-ae4a-b6b581d4f67a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.76']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e70ee3d-0c0c-4525-a968-8c05a11a5379", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.104.231.188']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a942933-1d23-45ef-9ea3-32dcd50b40a0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.215.96.13']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5020469f-0a03-4ac7-b348-86b7f1bac8cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.73.107.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d234d4c2-81fb-45c6-a356-674a667369b0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.114.222.4']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e6b999b-1ccc-43c7-919e-e6cc67214b91", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.194.241.86']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86533ed6-9484-46f2-9493-e538ad4b9586", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.224.178.162']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7821d584-897b-477a-b2aa-7c2ee560e3fa", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.224.224.49']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d16d738-b10e-47db-ba53-0f92790550cb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.237.38.63']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a91c9e21-864e-46b2-b734-d213cfd734f2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.8.163']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d9aba84-dd95-4516-a395-bf2b88b2cceb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.16.140']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fa19dac-117a-44e6-ad75-9bf5c68f70e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.32.245']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6601446c-81a3-47db-8c85-c31915a5c0f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.74.193']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a35ef9a-8e90-40e6-badc-47d639e18aec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.79.69']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e1de570-a4ee-4fac-9602-8bdb7eb477c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.140.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36b77884-8114-4256-be6f-1efb660c2bb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.38.171']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4777544-4c90-4365-b2ce-5cd922cd7758", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.145.117']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04586d2-a64b-44e3-a2d0-9586b8da2b57", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.145.77']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5084ee-f930-48c2-8d55-76274cb8192d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.136.167.197']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af230f8f-400d-4820-a4b2-71b36805ffbd", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.203.127']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1aa7878a-51f4-4ab7-9624-22a3ec451c36", "relationship_type": "indicates", "source_ref": "indicator--af230f8f-400d-4820-a4b2-71b36805ffbd", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--10a5b1ea-f62c-4e74-b69f-5eedc71ac769", "relationship_type": "indicates", "source_ref": "indicator--af230f8f-400d-4820-a4b2-71b36805ffbd", "target_ref": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cc53b923-c6ea-4406-8edb-15a834ce2b06", "relationship_type": "indicates", "source_ref": "indicator--af230f8f-400d-4820-a4b2-71b36805ffbd", "target_ref": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2019-5418, CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.110.100']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d38960e8-7975-4dc3-8db3-659c813a07f2", "relationship_type": "indicates", "source_ref": "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1400a703-8c6d-4e73-a076-e9b07e0460c2", "relationship_type": "indicates", "source_ref": "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "target_ref": "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1469bf10-1a17-4e26-8543-7d1e6041b0c7", "relationship_type": "indicates", "source_ref": "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "target_ref": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--54a08f92-7c67-44e3-98fa-4d69f82d3d57", "relationship_type": "indicates", "source_ref": "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "target_ref": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2019-5418, CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.232.47']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a9a9c9fc-82fd-45e6-b521-8b92c2ed117b", "relationship_type": "indicates", "source_ref": "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--74cd46b5-e645-4ebc-abb2-bc0fe0b87a8e", "relationship_type": "indicates", "source_ref": "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "target_ref": "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2bdca3d4-5981-4dd3-afb4-78530ef160fb", "relationship_type": "indicates", "source_ref": "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "target_ref": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1ace3998-c22c-432f-ad41-8418c4202195", "relationship_type": "indicates", "source_ref": "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "target_ref": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2019-5418, CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.62.182']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d844cd8-299e-4c9b-818d-27a42531dc8f", "relationship_type": "indicates", "source_ref": "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a5f5477c-d1cb-4874-b376-d28f13c0b1de", "relationship_type": "indicates", "source_ref": "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "target_ref": "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff7d90c9-cda7-4a3e-8167-deafa8aca97f", "relationship_type": "indicates", "source_ref": "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "target_ref": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bbe37c85-c28f-449a-bc17-012b9c5eeb51", "relationship_type": "indicates", "source_ref": "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "target_ref": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2019-5418, CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.80.173']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--996ee511-753c-4074-9538-7aa5d1a49e01", "relationship_type": "indicates", "source_ref": "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5381d988-6177-4413-b0ae-d385c048c947", "relationship_type": "indicates", "source_ref": "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "target_ref": "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8cb1167-8e27-469f-af8b-4368484a222b", "relationship_type": "indicates", "source_ref": "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "target_ref": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--294f65ee-b64e-4d42-9719-e843494fd5e3", "relationship_type": "indicates", "source_ref": "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "target_ref": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e668044-abb6-4304-86af-82762fba0bf3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.67.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42ce6b9b-acb6-4fd4-95d7-39292af6eedb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.158.91.71']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--660ee482-eb8e-40c8-ab3b-9af33e7f6fe0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.143.139']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d767142-04d3-4283-8886-9cdddd7bdbe6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.148.221']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463c381f-bee3-406c-825d-7a435d3afe1a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.0.96']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--690dadd1-0b2e-4ca5-8c7e-2841c88b3830", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.190.124']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--481a85be-3494-4f3d-9946-fbab10df8340", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.125.66']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa64438-9411-4d3a-803d-9a9c9e1192cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.250.187']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1664202-c068-45e2-b783-b0c8dab55c5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.104']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f207241d-e160-4066-83f1-5f909db508c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.196.217']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35729941-6854-43c6-82fb-7a94b877e7b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.199']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1d963d2-0819-4861-ab42-555d0be5ccb9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.23']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f227df-7fb0-446d-bd9b-274c4a71a432", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7d4eed0-ebcd-4f9f-89bc-e20857141e4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.178.180']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceeac1d5-41fe-4f0b-8ace-0d0946bc4995", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.207']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a74139-ec3d-44e9-87d5-315cc69dbd65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.41']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--949df8a2-6f8d-46e5-8c87-b442a2bdde1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.109']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--395d5823-c71c-49bf-a535-b8a2ac03dd2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.156']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a522a541-a598-4366-bd5c-285d701f53d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99e10663-dec9-4812-85a7-d9398e281998", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.208']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4bb8c89-eb06-455b-907a-6ac4f2992242", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.105']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb39122a-b233-47da-b7ce-33e1ee8f5556", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.231.70.214']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ce03f86-abc5-45f5-8fa1-4a51e4c72e7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.252.107.62']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b899f1e5-9c01-4bad-9389-244f3656b74d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.208.247.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e037289-f1eb-4ae6-a4f2-5175274f2b77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.11.228.39']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01cdf582-d417-4eb8-b1c9-0ee005415f10", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.164']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8fa32e-7a1a-46c0-a0c5-8fd452276089", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7032018b-81da-43a6-b51a-ac9244f890d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.147']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4870df7f-df89-4876-97c0-f6c4f2951eed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29846599-2a13-4ae6-a22e-76c9a4a345f9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87019cc-67ce-436b-b1ea-8b2be7b326f7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab00e98-5b02-4c46-b7e3-0a7b37932f90", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.240']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d76b25cd-8750-4f4c-a424-84616295c95b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.5']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94a71c4-4349-4b2a-a0d0-946bc2bcda2c", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.62']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aff62d2a-0dcf-43be-b354-7b9517ef4158", "relationship_type": "indicates", "source_ref": "indicator--d94a71c4-4349-4b2a-a0d0-946bc2bcda2c", "target_ref": "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a9775e6-75c0-46e8-9988-6790459c13a2", "relationship_type": "indicates", "source_ref": "indicator--d94a71c4-4349-4b2a-a0d0-946bc2bcda2c", "target_ref": "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd420b78-1bf0-4fb6-bdf8-0dc60edb8fee", "relationship_type": "indicates", "source_ref": "indicator--d94a71c4-4349-4b2a-a0d0-946bc2bcda2c", "target_ref": "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54669bc6-acb3-486b-a637-5159f946889d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.165']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e6a16e7-c653-4c7d-a8b6-a849438079a6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.154.244.193']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4816875-f8d9-4c57-b8a4-18a746e34c44", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e935e0e-b049-4a86-8c51-d66c96fc0e1a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.159.75.222']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--537ca114-00d6-46ba-84df-499375b4f1f1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.166.46.223']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e749ce42-0b2a-468b-b78a-117454142bf9", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.186.209.187']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e818ecd-6769-4605-ad57-90cbc4ed055a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.195.59.37']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca36f6b0-fc32-4363-a3bc-a8ae68fb5ad2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.26']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66504773-c65c-4d78-b0a9-dcb00df63e08", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.232.73.84']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3095c86-67f3-4540-a3ba-9e2b67a8bdcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.41.130.238']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15701a80-627c-4bdb-8ace-f55cf0408117", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.61.137.20']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3b4df2-3bb2-426e-a402-ce38d13409b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.61.187.220']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47394f86-644a-4e0d-afed-60a13556e2b4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.19.137.194']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ba77e7-edf6-45a1-99bf-2f0bbdac2fa7", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.19.138.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b77afd4-486e-4ab6-96e2-2c23068fac29", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.217.125.203']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff40c11d-505a-4685-9884-7d682f79171d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.36.123.92']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c81187-6266-4b8d-969c-7947382bee22", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.98.61.13']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40eb05b4-06df-4a04-9035-5a84dd4be128", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.106.137.69']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e48b84-cccd-4e0f-9d02-df9329ec962a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.108.250.8']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f71f491-76b4-4a46-86a4-32888708171f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.246']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1839671c-dc8e-4cc0-9c4b-72d96e30d44a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.50.119']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8789e48-4ef3-4c68-b462-663d0e0d6778", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.60.119']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec86b7a-f835-4eff-a174-67a0cca85fd4", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.243.247.233']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b66489ce-d502-42d2-9a88-77d14665279f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.85.200.242']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad8ee49-bbd6-4b41-8f87-b9787f62109d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.237.214']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84c9f04f-a082-4f88-8047-4796abc48857", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.207.246.187']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e5dcf05-882f-4e76-ae9c-d20e35e9abc9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.212.217.39']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a4dd72-ce9b-4e0f-8e30-6119b2c49f63", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.49.230.124']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da5213c5-9a62-4051-b6e2-7f18e5ba5b4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.178.45']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58478969-d200-4235-aa26-b029698e5cdb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.233.46']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f334cfa-65ae-4567-aabe-dc139fc03317", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.160.108.78']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79f4f338-bf90-496e-bdd3-902686812d0b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.178.198.251']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98c9f08d-1c85-436b-a1ca-7d90417d815d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.254.130.161']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cc30962-14d6-4df2-adf2-0cefef107df9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.107.137']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b60505a-6830-489f-9d8e-b869d744b94f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.107.139']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089323ab-8f78-40a6-b8d2-5c1ea6082088", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.111.199']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--affe2c03-608f-4652-b475-930ee35fd734", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.111.243']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--201f041b-c9fc-4c0a-9e05-fba3e7d7fe83", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.79.111.242']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4a3deff-8d61-4d6f-950c-c74280f9354b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.109.98']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f786a2-2532-4737-99ad-af9d7eec5ea9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.37.150']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b67dbc15-44cb-435e-9512-c4a6ff790ebb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.91.97.236']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a97ea7e0-ae21-4cbb-96bf-787a2f3766fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.140']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a570bd0-ca0e-4b82-909c-53141f51664a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.159']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7d39e25-f48d-4e45-8360-caf6049f17ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.161']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7856c57c-b1f0-485e-918c-496195f780f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.166']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--871cec43-a0c4-4e5d-8edc-665b3ed16e47", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.172']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e9c1ff-0cc6-4f31-8752-dfc8d60a9fa0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.173']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--980504a4-f151-4166-a6ce-fd1b5f4e34cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.179']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f02eaf0-83da-4b88-9c34-c074c5a2ee6f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.184']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c630fcbc-fb20-4705-9214-a2b8014c679c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.189']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2fc31e5-2a8c-4c59-b43f-95e13def9c79", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.191']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--554d6629-36d5-42d9-a24a-28b4e646423d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.195']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4921a2d3-709f-4767-b373-5536e71ee03d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.197']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0b100d7-eefb-484d-8c4d-570019e86c6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.21']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--739a0c9e-4fb9-40b1-ae66-1694609e4fe1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.212']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c815de4c-fb41-4f87-8c6b-372b7749a3dd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.214']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ecb4a3-3d68-48bd-813e-c08dd503e85d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.238']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9569142e-b9c2-4ec9-8644-65dc9b983ecc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.38.147.184']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b102672e-7b49-4267-a806-3360ab5797e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.39.136.7']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1669316-f0ad-416a-a122-149a9c49eee9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.221.60.25']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8106ec4-e564-46c9-8590-3a770157d479", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.76.159.170']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--726869c0-c158-43cb-a2e3-a869945850fe", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.8.212.119']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fa861c0-58ed-44a9-8886-5c098d0964c9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.126.46.246']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c09488cd-2d33-44b3-a84d-2d8b6f6a5295", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.7.135.117']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33b9e267-dc7d-4220-9111-c4b5f5cecb1c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.173.151.40']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26077318-1cd7-494a-90db-49033073e81a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.173.161.143']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15655759-f3ba-46a4-ace5-f2cda289ee04", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.49.56.130']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a851f0-a0dd-41b6-8222-fa1c4245ff97", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.163.115.205']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12803bfd-b9a0-4150-be78-6f2d09826f12", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.254.10.138']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae499131-906c-400e-a7a8-3062ad8f63e9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.64.92.118']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef477f2-18f2-4393-8738-6b3e74d9a71f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.182']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686cb09a-d42c-40c4-8730-406e0b3de65d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.160']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6360a326-81ab-4c2f-bc26-7d623e5f4573", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.139']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9e7fa80-8f5b-4393-8665-f710673c1158", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.141']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3db204b-58bc-4e23-8467-d6481c8f2ad5", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.163']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e70771-301e-4d19-80a5-04c821080a27", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.166']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5e17f86-fd0e-4d5d-93cb-db048b2e77a7", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.167']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca3a33b-584b-4319-970b-5614505abdf6", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.168']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f729cf5a-56fb-4030-9fde-ec2b945360fb", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.170']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b029f6d-c7a6-4634-98e2-2a9f8d491c83", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.178']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b079eb9-2d93-482f-8199-0c4ec02eed78", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.180']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebba1e51-d163-4e36-9855-b6cb9bdf6a09", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.78']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca998ce-c18e-4a2f-9461-1cde16b0a41b", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.91']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b487913e-94c2-47e9-a589-2f2757e9eea4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.181.127.40']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26c8989a-3171-42ee-9766-53fb732e93f8", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.172']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67601c15-f155-4ca8-bfd2-f667a5edff21", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.212']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--778dda81-88cb-4b8b-9672-92d6febc51b2", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.194']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d756bba-2d8b-459a-a193-93659cdabb33", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e1c3d68-4422-4097-b06f-70afbfaa879b", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.98']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ae57f42-609c-4438-af2a-4b7c47c32154", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.36.223']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3266f95b-1124-458e-a097-00de7252f39c", "relationship_type": "indicates", "source_ref": "indicator--7ae57f42-609c-4438-af2a-4b7c47c32154", "target_ref": "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f0de7b5-7fbb-4fe8-a9d7-b5e24e66c7e2", "relationship_type": "indicates", "source_ref": "indicator--7ae57f42-609c-4438-af2a-4b7c47c32154", "target_ref": "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9fd55468-64a2-43b8-8b57-1f7f80cfa602", "relationship_type": "indicates", "source_ref": "indicator--7ae57f42-609c-4438-af2a-4b7c47c32154", "target_ref": "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e270b2-a84a-4064-a93c-9f47f622197f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.65.35']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9081871a-41cc-4390-8952-2c1bbf5c7323", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.221.73.131']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac16da56-db49-4ad2-b588-e7a70195475c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.167.142']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed02201-dad6-47e4-a153-f81932674d7c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.255.18.194']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f8a2e7-d4f8-44da-8448-902139fec3d6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.47.208.90']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a430050b-288d-4d62-bdf4-e2d3ebc159f4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.94.248.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f6f8078-ca0c-490d-928f-89a41f28f2e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.117.86.170']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a4688f-3360-4595-a73d-5a48aa3b6bbc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.227.163']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652651bd-83ee-4ba2-a5bd-6880a92de220", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.228.10']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff328077-03e3-4294-89a6-b41d9db600ce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.230.4']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--790e77ea-fa3b-4b37-8a40-6f25887b54b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.36']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b28d57af-bac7-4a4f-8ccd-3b3bba1aad57", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.43']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9940241b-e3e5-4824-b6a5-c5890295626a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.71.99.200']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab63175-5ddd-454e-b45b-a7c3836b86b2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.79.213.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ff378e-dfb2-4474-b20c-9a0d414ebe27", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.201.221.36']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd9353fe-2512-49cb-9921-047aa5c34a81", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.222.105.230']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e40ec8d-6ae9-481a-b70f-fbdc03ef773d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.244']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f3f4e49-2dfa-4e3e-a3e2-4884b7b007ae", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.240.70']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc2a0586-40ab-4cbd-8a09-176200a39083", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.20']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--003813ce-7944-49c2-80bb-0674b688339f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.188.178.28']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c945287c-fde5-4dea-86d2-c1e453bf1bde", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.25.4.76']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acfbdc2b-c0f6-4009-83d4-59d756406596", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.127.175.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb60a0f8-b67c-4738-a02f-1a0932485535", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.163.97.138']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c8cc24-bc85-49a6-9450-a1cb7a718a6b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.163.99.213']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e96966ca-0666-41e8-914f-589b37300bd1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.179']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--001f0b3f-e30d-4ecf-80ad-d70e28dfa875", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.159.211.91']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76515519-6da4-4ad2-a8e2-8aac830d7bf3", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b7df1ab-39b6-47db-94ef-9556c2efebb7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.214.141.245']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f36219e9-6d31-4781-ab7b-9f4cec4ca0f0", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.182']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72010ce8-3735-4531-88a9-dec3c2f3d5c9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.142.15.236']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c8a49cb-3d66-419a-8aab-80ba2014a386", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.219.249.173']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05f00bef-aa72-4b7c-8e24-d3ac6e446df7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.17.60.251']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a2aaac1-516f-4ebf-8899-a7453c18e205", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.220.99.178']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4834a09-e1b8-4f52-ae30-c5876f0d63a7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.174.16.142']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--996ff60f-2061-47bf-ae8f-92762d469ee9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.174.181.226']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cd399b7-6c88-4d22-8950-a1d3c56b84d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2a21223-0e13-4b0c-a6b6-70ac3f810c58", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9bca2a-2a5b-40f9-9d37-40d7bc0e22b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfa9801a-cbe8-4d8c-aac1-78b016d2ad23", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720ff5e7-a2f9-481d-9ddd-3a9608a57b28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd7a21c8-775f-42ac-8265-c931bc0d9674", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e235bf7e-a0d2-4090-b26b-bdb1b6262484", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1818ac56-0582-4b3d-84b7-02bffadb7952", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067f08ef-3ec2-4235-9c9e-4809cbc6df01", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84cae8b-9e33-4c31-b56d-dd1b76f4781d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e42373dc-c017-4883-8a7b-685342e7d77b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fb2c868-74ef-42a6-a6f0-4b6184c61839", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56a6f80a-4515-4d00-b012-4eab5058a8fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--840528f8-a4dc-4b50-8dfc-9185ab1bca2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce0f43b-d0d5-4127-a22c-0bd789e7a1ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a56bee91-a706-400a-b834-d8f238565adf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--476600e9-582d-4883-9d5f-e579e61e6ab2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--993de8a9-a7e3-4299-ba1a-000360cf3911", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5093e6ab-254d-409c-afef-2c9c9a84e59f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40cc0404-c448-4986-a1b0-c2fc0e8eb96a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f3f7983-6fac-4a96-95aa-eacd2dea45a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.16']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5dfea57-3ff0-4454-bf40-938d8b2ab20e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.20']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02902cff-7eba-497d-a1a1-e81ce860695a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.22']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabcd843-cb21-408b-beb9-a7f7c4943131", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.23']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc7cc57c-d73a-4f00-b5f0-fbddea9a5d4b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.31']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b631351-9a70-4f6a-b02f-6a479e3cb97f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.163.93.64']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e250b048-2b02-4bfa-a98f-d2e5b52b9c17", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.106.44.172']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34c73e78-9756-4384-be29-9e0ec5c39fdb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.116.133.47']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--531fbbaf-f4ec-41b8-a551-46632fe719da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.58.197.201']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b3c5ccc-be74-4a7d-aff3-05156c620aca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.58.197.202']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--353ac4cb-a7e9-4e3d-abb8-f3eb42cda874", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.160.201.153']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97df7f2e-6e31-422c-807e-0833bb1d2c76", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.109.50.246']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3799bd84-728e-4a1b-b239-4f7329955db1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.151.165.120']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5134399d-56a1-4f52-af18-1dc3d59604f1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.151.189.251']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b3420a-8d86-43e4-8981-c6e5936b5311", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.3.86.239']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62ad187-9f3b-4fa8-ba1d-760dc83e2065", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.159']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a511e28-27b5-4fe5-a761-73a6aea6169d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.234.137.104']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79f53216-2a83-4df9-8999-ae2d0efe48b4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.247.76.37']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76bf7d4-a3da-49a7-b37e-638b31e35472", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.247.80.252']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2658df3f-4803-43ab-bd4d-fa0d21521d91", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.79.126.186']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bc896f6-58d3-467c-bc0d-a0dfdcba123f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.36']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f98fa4a7-82c6-46ea-9953-719e6e414dbe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.47.35']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b4e709c-1aa1-4396-aed2-be17ac9aa24a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.50']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e755494-a9ff-4af4-b76f-33fa80328fd9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.77']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb04465f-65ef-41be-ab20-61da9fe0fd61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.163']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db7766a0-1b3a-4939-891a-c1b7560e1792", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.171.79.119']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9de4cf43-483a-4152-bcf9-1ff855c684f5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.153.24.48']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--093f1235-8b3a-4662-9450-17900cd4934c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.154.43.29']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd10ce16-df2d-43d1-a67d-2e55214f8a17", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.241.248.154']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1727abf7-c93d-4f57-90f6-a52570f242c9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.3.52.49']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--313c00ab-0e73-48f5-b492-48af194cac9f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.45.136.2']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c92a130d-64bb-4d8b-8fcd-2cebcc28b732", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.74.236.238']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97c8e339-eb90-4892-910d-75cdc326a144", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.74.92.144']", "pattern_type": "stix", "valid_from": "2026-08-14T00:00:00.000Z", "valid_until": "2026-09-13T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-08-14-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d365af8-8e68-4701-989e-38f594465fc8", "sighting_of_ref": "indicator--51a645da-d72f-4388-9126-ca7c0ec56237", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--249bf87c-5390-465a-8cdb-9b4101df52c9", "sighting_of_ref": "indicator--b6fe13c3-f8b7-4f98-ae6e-6c592e58076d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e968248-2e16-46e3-b239-3e26e57f1151", "sighting_of_ref": "indicator--85ba71fb-2a4c-47a5-aa4d-4792c301dbc8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8679e1c8-2773-4383-b084-feff6aa82e49", "sighting_of_ref": "indicator--f7157617-7137-48ae-a906-fc828a1dd072", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9991e52f-45c1-46c3-b574-06b313586186", "sighting_of_ref": "indicator--a4f46a10-06be-432e-a486-526a189ecf0d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a8895a1-1601-404a-98e5-01eb7e958bfd", "sighting_of_ref": "indicator--16a90444-1867-405d-932a-e3e69477548b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b88791d4-b64d-4617-b26a-c9ad32917062", "sighting_of_ref": "indicator--3a1a1e01-b2e4-45ad-88d6-ce5ed7b1d219", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45dd3f77-22f0-4b06-b75c-02a0a5361040", "sighting_of_ref": "indicator--2631beb8-1a95-417f-8836-e80798eea332", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e98e8cc-6965-4c87-9d6a-a3fbf6f9ad0c", "sighting_of_ref": "indicator--ff18443a-125e-415d-8967-d9c75ef9abe6", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41817557-5b26-457c-a86a-f2a6b1e43819", "sighting_of_ref": "indicator--e57f3658-cd4a-450d-aa84-9f1b885512c7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae4afaa-a143-4af0-bce5-6916ad9b43c8", "sighting_of_ref": "indicator--da37f661-bc31-43dc-a627-70130270c414", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--044f34c6-3a35-4274-8365-819c8447968d", "sighting_of_ref": "indicator--3863cb7b-434a-4a42-876d-07f310738c87", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e64a5a1-8266-42cc-8e00-f16149643c7f", "sighting_of_ref": "indicator--3863cb7b-434a-4a42-876d-07f310738c87", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea6e2a7-57b6-43a4-a46a-30ac61c7a27a", "sighting_of_ref": "indicator--3863cb7b-434a-4a42-876d-07f310738c87", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9a3bcd-984d-4be4-b1f7-4f8c76a71bf6", "sighting_of_ref": "indicator--af223f3c-9fa0-4897-b40f-20479ad864f3", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--622bacd3-3674-46d2-a120-5dbf99b481df", "sighting_of_ref": "indicator--9a07dbad-96eb-46d7-904f-b2228add5ebf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9460aa65-d3ba-4e18-9d21-67b1ab1688c4", "sighting_of_ref": "indicator--5004ff9f-46b7-4c6d-87dd-dceb62957202", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2ae3259-87d2-452b-967e-aa4ce6a88d32", "sighting_of_ref": "indicator--822e830a-9008-434b-bd3c-e509180ac19f", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f0dcfe-b298-4651-b970-12eee7c395ef", "sighting_of_ref": "indicator--a11a022a-75a7-4bbc-809e-2d1148938ea8", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4a4ab62-5eeb-488b-aece-0564a622f2cf", "sighting_of_ref": "indicator--f4ea2e56-b9e4-4b54-8da2-78e852be10ac", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7abf168-1db2-4f65-ad97-79379886c53d", "sighting_of_ref": "indicator--e216bf90-430a-45b6-9a3e-d0a236747095", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81de7c65-24bf-422b-aa59-08e0d2f53fa8", "sighting_of_ref": "indicator--9109c39e-9099-4495-b049-fd9331eea615", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--978cf56f-dd46-4aaa-be90-b95f8a4a61cd", "sighting_of_ref": "indicator--95cf18d1-1a5d-4605-81eb-206899be948d", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45d6c491-3505-4fae-b8fe-1ccbf72753c6", "sighting_of_ref": "indicator--7d5840c7-c288-4f78-b2a7-b7b942e95ca4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afc5c34c-57be-405c-9f8d-7a71de45f680", "sighting_of_ref": "indicator--70c77c37-ab20-4f15-ae07-125cbfb9966e", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2bd5cda-8b3c-4a61-a11f-dd2aca35c2de", "sighting_of_ref": "indicator--30cfa224-b942-427e-b135-b27dd096cbd2", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58745dff-197c-40bb-8640-257b4d201fac", "sighting_of_ref": "indicator--36a9f9b0-f8cc-4d0e-aae6-3437b9f1dfc4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb99443-fe08-4b80-bbdf-f9e7f7962849", "sighting_of_ref": "indicator--2a84a8d2-80e8-460e-bcb5-b9a978346373", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd13d9d-1903-47d0-bbe3-36a5add61a76", "sighting_of_ref": "indicator--4a835d45-3768-4599-9508-b4b70b02b6d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7e571de-e09b-4a30-bc82-038cdc5895a0", "sighting_of_ref": "indicator--8c443def-cbaf-438a-be27-ecdc99f4fe71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db70de09-053f-4e28-84b9-8c423d055048", "sighting_of_ref": "indicator--3194a6da-3b58-4812-a8b1-14918bcf737d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db33cd84-1792-4f67-8a93-101740926b91", "sighting_of_ref": "indicator--85c9674c-7565-4d69-82e0-59baeefe59c2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99404dcd-74ec-4c89-8fd8-3154e149b312", "sighting_of_ref": "indicator--f5b88698-3e74-4e47-9681-1c67137be68c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94170c9b-ceda-4dea-a5be-eff59116239a", "sighting_of_ref": "indicator--1eec236b-8c75-4d1b-b5c1-a27df9437ffc", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dda0d07e-2fb7-4100-8d41-3c5524e7f5d0", "sighting_of_ref": "indicator--03ac1fa2-fced-4aab-8ff8-43a4efe8f3c2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0178a529-adb0-4378-8a70-4110088dfdc8", "sighting_of_ref": "indicator--783040ef-8c03-4922-95b7-9e0d3a1cb0a2", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc08dfba-bbb3-44bb-854e-c879a4c05deb", "sighting_of_ref": "indicator--3a08259b-002b-40f2-903c-2cb70567d5d7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66f626b-106f-4baf-946f-cdf46f2f6aaa", "sighting_of_ref": "indicator--e3e1ae14-1632-4a1a-b04f-e6cd4454507c", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4e8dcee-56e7-4500-a3b3-87f9e0068cfa", "sighting_of_ref": "indicator--4c777cff-2f17-4d17-ba29-9de0d9d726b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bebe7f89-6962-4ce3-a0a6-296223651fff", "sighting_of_ref": "indicator--12d3fb82-9e08-41bf-8b5c-f731106f818e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b1192ab-b121-4c85-add4-4961c5417113", "sighting_of_ref": "indicator--840421d0-0e7f-49c1-944d-e1b7f97e0bcf", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4541d876-a2a0-4e4e-bc3f-dba98c9ef6bb", "sighting_of_ref": "indicator--9b6c5270-ae4b-4935-a1b7-c3f050c01d44", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c66d203-0b74-4974-bc59-46b8b641e7e2", "sighting_of_ref": "indicator--9c05dd56-9f84-46a4-b5f2-3b8e778d36f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--773b4b2a-1abe-4d6f-aea9-99cff1246d2f", "sighting_of_ref": "indicator--52b5d6bc-c234-41a3-a517-fe8e06ba2eb5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd90d7ad-fc14-4a06-b697-4986a7c280ba", "sighting_of_ref": "indicator--8db05bb2-cc99-4f28-a25c-b0caa746f7a4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--055be9df-c7be-4679-963c-c7a1858a9444", "sighting_of_ref": "indicator--4bf20a9c-0b57-4a93-95cf-c67e1349cc44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c90ac27b-e05e-4196-b0b7-fd06777e0a4a", "sighting_of_ref": "indicator--95cec8b4-1a4b-42a1-924d-5933e9979fd6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f41beec9-e7a6-4a17-823c-71e7bf932b36", "sighting_of_ref": "indicator--0e40d887-5dc6-47e1-b8bc-afd01b086511", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6c18dfa-03e5-4bb4-ba17-025750f97394", "sighting_of_ref": "indicator--0e40d887-5dc6-47e1-b8bc-afd01b086511", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90c61461-23dc-4a8f-8c1f-01a9f9427234", "sighting_of_ref": "indicator--0e40d887-5dc6-47e1-b8bc-afd01b086511", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd31c469-b645-4a75-9155-3fa3f1c64af1", "sighting_of_ref": "indicator--3b8e00bd-b049-443a-8faa-8e9ea419bd91", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--557bf6ae-89e3-43ac-9b29-3d88e922bf27", "sighting_of_ref": "indicator--6b1139a6-ff14-4dde-8504-6b68cec1640c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--424758c2-1f6f-49ca-9915-29e46b6d5046", "sighting_of_ref": "indicator--b4c4f730-b58a-4c29-b55a-7ff18fd46c3d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b24bff4d-d3ee-4512-9da7-0d3111c8f4e1", "sighting_of_ref": "indicator--95fa9599-6cc1-44dd-8a46-c588d61bf6b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe914e8-294e-40c3-8b9b-ea61715d6ad7", "sighting_of_ref": "indicator--0205b77e-1490-43b3-81c6-89ed162a645d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b3db5bb-04b9-43be-bfdb-9ec2ca0a92fe", "sighting_of_ref": "indicator--cfe478e6-0f26-48d6-b776-0f196923d733", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d35938ff-4ae8-4962-988c-b840f6417911", "sighting_of_ref": "indicator--3cfac35d-04e5-4d80-99be-62d0e304aba4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53522218-9bad-4556-bbf9-b7af34eae7ba", "sighting_of_ref": "indicator--9bb9d56a-e8ca-48b6-9e29-c0907e7f541c", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--484d2aed-0c78-4d77-8649-be02b818c01b", "sighting_of_ref": "indicator--b68a6eea-963f-47cd-bdd2-2cccbb40e342", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92a3ce59-fb93-47a6-affa-a045dd250b4d", "sighting_of_ref": "indicator--22cb9b41-3fd5-4006-91dd-dd0a004fb6a4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d4cace-4a86-4d4a-9731-4dc1d6dd0206", "sighting_of_ref": "indicator--bbc221ca-c377-4479-8e4c-1a7f81dafcbb", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f4c814-f7f9-4e7b-a26f-6dbe99c70a02", "sighting_of_ref": "indicator--b1bae2cd-a323-4eae-aa90-d0538ffc3fe9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dceba659-0876-42e5-b48f-3fd018e3129e", "sighting_of_ref": "indicator--3ea69c05-8c41-4cd5-b9fd-02b8dac83ec2", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6774d024-b30c-4c43-a08b-be716c15a73f", "sighting_of_ref": "indicator--7904a2a8-227d-4bd6-9c8e-8ca1a4b9f154", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--866a2074-36bf-4bdb-a483-7818778248f3", "sighting_of_ref": "indicator--05032dc6-3ee4-4c74-b4f8-df7794428484", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b6e7e8c-67bf-425c-8306-a34c03d9f3d8", "sighting_of_ref": "indicator--76c5e174-c8ca-4f18-b632-f3bd3215430b", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b8309ad-5107-4175-bc40-90b53089abf4", "sighting_of_ref": "indicator--83ba6a59-e50a-4d6c-9790-c5a1ab8dcfe5", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10af1bd-cc30-4ad3-b9f6-805d6be77e40", "sighting_of_ref": "indicator--49873cb0-1c56-46f9-a37d-44f9eba6565c", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--135e6c99-9494-4ce6-a00a-edc5c36fb516", "sighting_of_ref": "indicator--189c9916-96e5-4c10-aacf-e94d133562f9", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--369be024-48e2-4dcb-9db0-2bf421da197f", "sighting_of_ref": "indicator--50690b1c-4b04-47a7-a820-22a371531efc", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e172e1a-8970-4f8e-8bd6-b56ae23492a6", "sighting_of_ref": "indicator--9881531b-20aa-4bf9-b5d6-c8099c79b6d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4faf92dc-430f-436c-ac74-c3ebd94edd5d", "sighting_of_ref": "indicator--8f1eedf9-3b6f-44ee-929b-8960cd99df80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5e337c-8dbe-4a17-8ef1-0085ff12518c", "sighting_of_ref": "indicator--40401d2e-4e3f-48bc-b262-a9382e12dfcd", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877afc7b-cb99-44f3-8abb-c7687a45d425", "sighting_of_ref": "indicator--1c0c3694-247d-4547-88dd-6235ea4a239f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674b14bf-fe0c-42c7-b41a-65f217477d65", "sighting_of_ref": "indicator--16481229-290d-4aba-9fd2-6b986eb5c37a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--375f57ae-18f6-4eeb-afb7-59a2da9ebd4e", "sighting_of_ref": "indicator--63c9e58a-ba44-4535-8e88-ecd27cdfdc82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--649237b1-ad9d-4252-b337-a91baba24a3a", "sighting_of_ref": "indicator--d481c114-32bc-430a-9843-9336f5de1fed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cec5150d-f1c2-48da-94e4-dbb8416c58b1", "sighting_of_ref": "indicator--51121527-f359-4ed9-9ab4-c93f1872b64f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3d69820-614c-4651-b543-17a36f4e9669", "sighting_of_ref": "indicator--c5094e74-36e4-4734-8e5a-a0261d0c1486", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7699a2f9-9d61-49d0-ae28-924c09bdc058", "sighting_of_ref": "indicator--af5b1ccb-a2ab-4c48-bb15-0fa2136aa04d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf690b48-e741-47b7-a043-6f76f64adf18", "sighting_of_ref": "indicator--592bb99d-fdf0-4f9e-8b6b-6e38080c288a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3352f8e-2a04-4040-85af-c98dfc40982e", "sighting_of_ref": "indicator--017d27bd-d31a-443d-9a2b-4ea0c9a0411e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--814a3f53-0eb1-4c65-9501-ed96f29fb724", "sighting_of_ref": "indicator--10f15cc3-25b8-45bc-b779-a823525478d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0672468-c2ad-405e-b4fc-2143842a9893", "sighting_of_ref": "indicator--d112eec7-a9b5-4fdc-ba2d-31f8ca9f291a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227cb10b-4018-4efc-880b-044afdbff0cc", "sighting_of_ref": "indicator--064ee60a-03a7-4fe4-b797-d5899be203aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4b0b16-423e-4b30-afdc-17d9deceee26", "sighting_of_ref": "indicator--e18d90d7-1307-41a0-92d6-9ee6896b437e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c848c9e-4798-4309-b2aa-b37d59056296", "sighting_of_ref": "indicator--2255412e-cc15-45be-a9b9-671a4c9cdc54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59ae3fae-6946-4865-913c-f574bcd31548", "sighting_of_ref": "indicator--b2830eae-31d1-46d1-9e0a-5b4d65722f01", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f162d17-78ba-4280-b567-cdd6817ce991", "sighting_of_ref": "indicator--427ee8ef-0f45-489a-b4f2-499c6cf07a11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a02bcb0-b615-4177-8e08-33dea923a8b4", "sighting_of_ref": "indicator--c1633aba-dbc9-48fb-b615-322e4eee36f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e8de73-e68a-40cc-8b3e-4f464a5b193f", "sighting_of_ref": "indicator--d1a59581-ff6c-488b-aa34-dfd4d660738e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56b50751-4b61-461e-8dc6-384bcaed9117", "sighting_of_ref": "indicator--7f7480d2-082f-4227-8e06-070facbc2ee5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeb56b93-b433-4561-8511-83a2bd0b181c", "sighting_of_ref": "indicator--18fc8679-ff95-4efd-aebe-fcc79233bbc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5928083d-72ed-4513-ac2b-3b2449ca582c", "sighting_of_ref": "indicator--c748a2b2-3d51-40d5-b311-197fec4eba85", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8629d718-157d-4a14-8f2e-715bd5f47a7e", "sighting_of_ref": "indicator--3ee26913-8a96-46cf-96db-58c1ffbb911c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fec9beab-75f0-459f-83c1-0eb07405d9f5", "sighting_of_ref": "indicator--0607b022-0afb-4b3e-8d38-d900cecf3d13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--194f6495-d798-4b56-be9d-24b61c711c1b", "sighting_of_ref": "indicator--4b937791-d48f-4d35-8a8f-82799c94eb9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ff9a71-7535-4ec2-845d-2e8d6bb07941", "sighting_of_ref": "indicator--bac0c25a-af2f-4624-ba37-15fb7da64a86", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1201e05f-b260-484e-829f-c02613d1ff31", "sighting_of_ref": "indicator--6daa7c8b-722d-4f1b-9749-d1f8233a9d71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f429e3b-14d5-440c-ba7e-ecf574d47eaf", "sighting_of_ref": "indicator--b8361621-1b89-49cf-a114-ef26599d1ddd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e146c55d-0f66-4b38-b913-c56aaa1faed8", "sighting_of_ref": "indicator--ef579ff5-b788-4114-80c9-350468587006", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cd9ee14-8929-43e1-9611-0678706f99cd", "sighting_of_ref": "indicator--9b65a0cb-95b4-4a78-904d-209aa3ac9ad3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cea93edf-2678-46fd-b9d5-e223c7040e6b", "sighting_of_ref": "indicator--93545637-03f5-4d8e-9116-7058200a8768", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a8fcc3-773c-4178-932c-99752e63141c", "sighting_of_ref": "indicator--091d0c40-24b8-4f78-ab64-79109924ecb0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba8568a-f2d0-423e-9621-5575929bbede", "sighting_of_ref": "indicator--90d74712-4570-463c-ac77-c3591526d7c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4443cce-f205-40cc-8603-966cf98409b9", "sighting_of_ref": "indicator--06d0793f-e598-4c2a-a06c-42e674ead770", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71a7cbf6-8312-49c8-a632-7de7f695a66c", "sighting_of_ref": "indicator--25d5fc31-f6ee-4218-9f97-4cd9a6732063", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f667825-9547-45c3-8cac-e0592d3f752d", "sighting_of_ref": "indicator--a8bb9372-bcef-4bfc-b18b-eb18455b4440", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a636b14-f83c-42ba-b652-080a037152a6", "sighting_of_ref": "indicator--b9d3ebf3-d4f7-4359-a117-c9fe39a2d5bb", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--385280f5-b21c-4160-b7c2-f26b065a8733", "sighting_of_ref": "indicator--16f7adf5-c8f7-4b1b-a406-9a20d80335f3", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a030a2cd-059e-4aac-b389-ee000b63eda5", "sighting_of_ref": "indicator--4ecfdd57-c575-4708-ad8f-b83a690fd70b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ab1371b-ac02-4f1b-ae2f-14a4cf3a9354", "sighting_of_ref": "indicator--75810cbe-65e9-44fa-9e5a-115e13e73944", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337864e9-f877-43b2-ab8d-022cfa749ee3", "sighting_of_ref": "indicator--ed26404d-fdf7-4ff1-98b5-0f5cd28f9514", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4f8ca05-c299-4ace-9bfa-399d24ee05ea", "sighting_of_ref": "indicator--2a483aa2-5707-4057-971d-1f63598ba6e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--290471ca-4612-4661-9af3-cfe85a0bf813", "sighting_of_ref": "indicator--808569ca-1774-484d-8a32-835fb1cf7e89", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c91300-c682-444a-acdf-147a56fc4ce7", "sighting_of_ref": "indicator--ab6a0e2c-2df1-40ea-82a2-1b2d0e2f60e5", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46ee5bae-547e-481a-9b0d-4b7f0d3f87b6", "sighting_of_ref": "indicator--854985bb-6428-4272-953b-b978b3988c1b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--356363f4-f76b-43b6-86b8-da7089a0f282", "sighting_of_ref": "indicator--854985bb-6428-4272-953b-b978b3988c1b", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86255137-e143-44e5-a71f-e2eafe42d2d3", "sighting_of_ref": "indicator--b7699c8e-bf4f-4b81-be4e-b49ccdbd27aa", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c34c70-69df-4c27-9c68-28cea36f50ad", "sighting_of_ref": "indicator--b7699c8e-bf4f-4b81-be4e-b49ccdbd27aa", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac7cf5f9-bdb2-49a3-8c3e-1db43fe344cb", "sighting_of_ref": "indicator--004bbef6-d6c5-43fc-ae7c-0bf53b265841", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--487b4533-86af-4517-ae0d-0298f1817c5b", "sighting_of_ref": "indicator--f355b202-eec5-450a-9b5e-ed84b5222255", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c20da4da-5f06-40fb-8857-cb0f3b011833", "sighting_of_ref": "indicator--5df2a02c-074f-46c0-a7b6-6a8d7429f2a1", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d13e2d1c-50db-4e4d-912b-cc3f5ce2439f", "sighting_of_ref": "indicator--f92f81ba-42bc-424d-9fed-e575f7ae102d", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28705d7b-8c44-40f6-8157-f3823bae8b47", "sighting_of_ref": "indicator--37a9cbc2-1a98-4238-b2f5-fc306985bc5a", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a58f2c-9993-495b-bcde-4967597aa4a4", "sighting_of_ref": "indicator--a029c972-daaf-49ab-8b82-c9ec659cf1ca", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962be888-e56d-437d-b5ad-46697b7d0c75", "sighting_of_ref": "indicator--b295c789-e957-4939-b930-c4363eaa2c09", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9605ae75-526a-40d2-a628-98e48fb23fc7", "sighting_of_ref": "indicator--16d99856-7233-4123-95cd-396f6fc93987", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df833ed3-326e-45f8-8f74-364b84d0adbb", "sighting_of_ref": "indicator--d3909260-231e-46fe-878d-c4ac16f1b68f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6deba476-c6de-4694-814f-7fb60bfba0f7", "sighting_of_ref": "indicator--957c9ada-0512-420f-b353-920444506630", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86155a49-b0a1-432c-8ba9-0bd700dbc819", "sighting_of_ref": "indicator--6b35cad1-238e-42a7-82b7-d4fa86985bf3", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f131eb65-f1f5-472c-9e55-4644eab6183b", "sighting_of_ref": "indicator--e90a303e-3187-4a29-bab5-3c6cce14bddd", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a76b6f-10db-4a79-a042-db72eedf84c9", "sighting_of_ref": "indicator--c84081be-8098-44cc-ba88-348307ed3b14", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9a3dd24-5baf-4562-8a06-5dcc9e548c09", "sighting_of_ref": "indicator--d9d88e5d-b768-4773-970c-4948cf086693", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5118b05-49e4-4a83-9160-5989023e4059", "sighting_of_ref": "indicator--8441ce37-27b8-46d5-bc3b-c71e22ea8dd2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2717a47e-0e8e-4cba-bea7-8e21842e79b9", "sighting_of_ref": "indicator--cc96be05-33ab-4d71-aa9e-2990e360633d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f472b4-3d58-4da4-9264-7ea033f37076", "sighting_of_ref": "indicator--4ad6e7d5-7941-4020-8835-fecbc8f964db", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58bc7ef6-9624-4bd9-a8eb-6c2e9541fe19", "sighting_of_ref": "indicator--abcb63c9-83b1-4e94-bdbe-30c2ea23d642", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e4e85e5-e1ad-4ae5-84e4-f558e9b2a2bf", "sighting_of_ref": "indicator--c28de4da-0638-4a66-92d0-83eb7e74d3f4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39cb2bfc-4711-457a-8ee9-dadf42cb800a", "sighting_of_ref": "indicator--56067b16-a001-470d-b54b-6daf51c8d243", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b94c99-8870-44d4-92f3-15d8e12bac39", "sighting_of_ref": "indicator--d2aef9b6-dac3-418e-9eec-38a57fd1508c", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d118c6-41bc-420e-91bf-c2d74a0461d0", "sighting_of_ref": "indicator--e1657ce9-94f9-47bb-8e3a-f34aa1d04bc9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3733e7b0-689e-4f52-bb97-045eb784330d", "sighting_of_ref": "indicator--54324154-91cf-42c4-be09-0fcb561c73c5", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188a475c-184a-4029-a643-0043cd7dbcf4", "sighting_of_ref": "indicator--eaba6b6b-aa0c-43ec-bf85-0a656a78dfab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3dd6cc1-3939-4314-bfcd-497bf10fa11d", "sighting_of_ref": "indicator--390e69eb-e1c3-43a4-9c29-aa02e6f4ef8c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54dac66b-3e56-4b51-8cb3-8481e16a2e98", "sighting_of_ref": "indicator--00bb57fc-1493-43c8-a1e0-971528d35a18", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013eb7c7-c6a9-4ca0-bfa7-b7e88b2aa725", "sighting_of_ref": "indicator--6cffe00d-ff41-4c4d-a039-e47ea0d7403b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2ea3124-80a2-4e83-87c1-214099894b5d", "sighting_of_ref": "indicator--2fbbc3a1-5546-4215-be2d-cf3d4e047f6e", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--518575cc-a96e-4acd-a1d3-2540abbd66be", "sighting_of_ref": "indicator--984f4832-88b9-4f3d-b3ba-9f021ddb3797", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d467618-2035-42ad-a99d-e3559b634532", "sighting_of_ref": "indicator--a589a08f-9cb3-46e5-b7d3-809fbc4c3666", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6b3d1d2-11e1-4519-9b16-fd8f568417ac", "sighting_of_ref": "indicator--ba5ef5bb-2679-44dc-8e11-e0f72098f000", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff67912-9aff-4568-a2f3-6f1d08b35f49", "sighting_of_ref": "indicator--65923a65-5ebf-4da6-95e0-ebb365304ea3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c9323e-fe6b-459b-8ab1-c3eb6d003b80", "sighting_of_ref": "indicator--c4c6e22a-9dfc-4c47-967a-ced5c5b782f8", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f969814-b529-4c5f-9470-f1c242289972", "sighting_of_ref": "indicator--af5af0ab-8ed4-4d72-9673-13dc77a24408", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42a5b250-19c1-461b-8662-2b6efbb7048e", "sighting_of_ref": "indicator--e3241520-4b0f-4735-989d-484a52f622d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06aeeea1-e181-41c1-92b5-1ba09bc82709", "sighting_of_ref": "indicator--b25bef2b-55a8-4ea3-9c02-4ebd28ca5687", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aedd472-aded-42ea-95a5-b0535cc52045", "sighting_of_ref": "indicator--9bc9eb02-b6e5-49ef-a23e-0aee218313a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8d0317-6297-481d-a512-f07748f8ff4b", "sighting_of_ref": "indicator--8ef2caf4-eb62-4dd9-b7fc-208a86f9dea1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246933f3-c527-4ef0-87c5-eea2427de305", "sighting_of_ref": "indicator--0c40870b-6395-42e5-9a70-f828443dbf35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab7e0a75-e341-4b05-9cc5-62be7f6b8a01", "sighting_of_ref": "indicator--ff666a88-0e75-461e-90e1-cc37b6e622dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5b5eb93-7e58-43ea-b166-aee4ff2eef08", "sighting_of_ref": "indicator--321778e0-4a37-4ce3-97cf-ce0b7c6ccdce", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a994fdc3-10ef-4a52-9933-99794e75f888", "sighting_of_ref": "indicator--d6a2714c-0746-4e59-94bb-9c4cc83e1cff", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3666fb2-5ea6-4b8b-a7ef-445bafa4e6e0", "sighting_of_ref": "indicator--bf5545b6-5c5e-4917-aa71-9bb061060082", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--390f2433-bdb8-4659-b6bd-103fab1aa7d9", "sighting_of_ref": "indicator--1f905f9e-23b8-4fff-baeb-e3723a4f2e77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72497e25-a721-40c7-8ce1-4f95dd6a35dc", "sighting_of_ref": "indicator--c32eedca-df78-4a36-b6ef-376142b6bec8", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc3ec917-c313-40f0-a80e-a2dc7fb33b0f", "sighting_of_ref": "indicator--afc37e95-14c7-4d8c-a55a-b78bc1177fb0", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6758ec3a-da97-43d5-8a97-908fe3590978", "sighting_of_ref": "indicator--a14a3f13-38eb-4c1e-b503-27ecc45907a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee6fd251-053a-46de-a49b-53d97ca4543c", "sighting_of_ref": "indicator--8bdf5d65-dd01-46a0-bb2a-85de2b252d0f", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9251218-12d9-4516-8df6-963573cc2d58", "sighting_of_ref": "indicator--ac828e66-9fc8-4345-be77-7921d8a8951a", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--678d726c-79b5-4119-86c1-52abfa6ed5c9", "sighting_of_ref": "indicator--e81a5ec5-b17b-4470-8c2a-8353900b2c7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d60b8813-25bf-4541-98db-329740de6e06", "sighting_of_ref": "indicator--80c4b1cc-3870-4b91-bb61-15a93294fb93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80418e5a-4601-4985-b8a9-14997aaada30", "sighting_of_ref": "indicator--b1b4530a-eae9-4138-b680-4b3755dc7430", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e16999cf-2df7-4422-985e-b6b7282e0bb3", "sighting_of_ref": "indicator--abb54623-cc9a-40cf-b1c1-30de502670f5", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d841bc5d-dcc1-49e7-8175-f85152b2974a", "sighting_of_ref": "indicator--46ba8951-e9d9-4d38-95d5-bb654044e113", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b2e88d6-bf92-4657-9082-cdf8446a4e4c", "sighting_of_ref": "indicator--e055f216-5463-4da9-8c52-bc669d273aae", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12d9593-2941-42c2-bda1-14ed776fa5d4", "sighting_of_ref": "indicator--cd7c7838-736b-4189-9271-85282aae0463", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52e27fa1-c89f-4186-8a51-0a8e8d91a6d1", "sighting_of_ref": "indicator--9ebdf27b-367a-4976-ba61-f4ccf270b95c", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d605e07-7e42-4b87-8168-8e96a9689ecb", "sighting_of_ref": "indicator--8a006cad-a0ad-4684-a0a2-94fdaf26b512", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3a89b9-eb67-4a16-91e6-74fa83e4689c", "sighting_of_ref": "indicator--6cf10526-628a-4959-af5f-5e248c9651e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa50982a-4789-4960-89e1-e1c326eb4c69", "sighting_of_ref": "indicator--2a4a5258-2fbe-4da0-b868-893f24ba08fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a3914f-4441-4236-927d-9db708ee712f", "sighting_of_ref": "indicator--c69d5d42-304b-4c00-9569-f5f5b51b828a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--181e1fb5-2532-428c-b9c7-4521627f46c3", "sighting_of_ref": "indicator--d23f2952-9e68-4df2-901d-2ff3de625173", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3168372-4260-485d-97ef-c4390182527d", "sighting_of_ref": "indicator--aa083b09-32ba-4a03-8e40-19391afbafef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c060d35b-0ae8-48f7-aab4-95dda5888487", "sighting_of_ref": "indicator--17349ce2-ce07-4e88-b5ac-dd8126d74ab8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1595fc8a-9a88-4bef-99f0-7826d1be00bf", "sighting_of_ref": "indicator--392a63e9-c3be-4f04-a183-2fc2276fbc16", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--296c7cdf-c8d8-4d6e-8d40-92996a422cda", "sighting_of_ref": "indicator--9acc415e-341c-44e2-8188-32232993b770", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--016f8748-d023-4062-8c80-1cb85b86db5f", "sighting_of_ref": "indicator--4ad7042a-bd33-4a8c-b553-e7390db5bbfe", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56e7c966-e984-4123-ab9b-8fdcc5cf4d76", "sighting_of_ref": "indicator--9d10bbf1-0ded-400f-85bf-3fff0b35f6f7", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4efd7f78-032f-468a-a5e5-61013c6753b9", "sighting_of_ref": "indicator--9d10bbf1-0ded-400f-85bf-3fff0b35f6f7", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c232221-4445-41a0-971f-ba005e6731fa", "sighting_of_ref": "indicator--0983e42b-410e-44e9-8922-00c063966707", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d758cc-f7fb-42d4-bd2e-dd59c4fbc51c", "sighting_of_ref": "indicator--96e8296e-bf7d-4937-969d-c97123dc58f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe734c80-86ae-42fe-a0c0-d6d1e863baf9", "sighting_of_ref": "indicator--7fcb1766-8ca0-4a8b-b9ef-c8a68aacccbb", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--273c3744-c0d5-40e0-88e5-6f7b27b047cd", "sighting_of_ref": "indicator--38cde433-981e-4a60-abc8-05a6d5a5bf48", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7b7581-ae23-4094-b4db-f128d77e840d", "sighting_of_ref": "indicator--20b96bb6-0744-4b1a-8c3a-5bc9487c35ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a95e64-5d49-4f53-9647-cad779d8f8d8", "sighting_of_ref": "indicator--2a3eecd5-e4a7-42da-836c-f8f78ba56452", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79237d4f-fb60-47ab-9ca1-ba0f2fb1beb0", "sighting_of_ref": "indicator--388b3a14-7b2f-4f68-ad9a-747f0bb00db7", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91ce0ceb-12fe-441b-aa4f-80dcca6ffe6f", "sighting_of_ref": "indicator--c14ca714-b62c-4df8-8147-8e439bb900d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b684aa90-3c55-43c6-a170-c04b2fa4a78d", "sighting_of_ref": "indicator--e1829eae-be33-4e09-8d16-82dbb8907311", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535cd57a-ffa5-4b97-9124-78ba9ed8cb9d", "sighting_of_ref": "indicator--bb6e6ca4-cf14-4071-8b60-546816514a77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f1a2d6-f432-4a30-a257-7ec686c71ba3", "sighting_of_ref": "indicator--e933b770-bdf0-4664-8da4-2075ea21f78b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8b8717-e854-4c99-8a95-083dd545be7c", "sighting_of_ref": "indicator--a7cc9702-7e58-4118-b5f2-06c2cb1a45ac", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd12124-6873-4ecf-9e54-6783b0b92eb5", "sighting_of_ref": "indicator--cb55f79f-028a-455e-8452-c9b68cbd42fb", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3be83d4-2fec-4f2d-b0e6-efa36d23ede2", "sighting_of_ref": "indicator--4a00d735-bca7-4800-9934-efd8167e987a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11611f2d-80f2-4829-bc01-ccf7b31bdbae", "sighting_of_ref": "indicator--b7cde0a9-6758-40b2-ac1a-b4dad7d3d7b4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac7a5d4-cd57-480b-9f4d-1a200177e227", "sighting_of_ref": "indicator--c01ffd54-5275-43ea-a288-cf9f58ca30da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14d5bd7-5421-422b-85d4-b149494113de", "sighting_of_ref": "indicator--aee1b6d4-f6e1-4a8f-8def-03231f52bf9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464d0efd-71db-40c4-ab29-254b7ccd2505", "sighting_of_ref": "indicator--5320219f-e620-488c-bac3-5f0b9c1168f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c346b1df-51e2-423a-9729-1ab69c4b3a35", "sighting_of_ref": "indicator--37cd7bc6-9e00-4d72-bdd7-48f5ed912fc0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46e5bc6b-119a-461c-91a6-a54742b487d2", "sighting_of_ref": "indicator--6f63a246-1fb3-458a-a824-3ad5d909012c", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1379cdb-c384-45b0-8122-0746d997166d", "sighting_of_ref": "indicator--4615e02c-ee94-45d1-8e0f-0e293a48acac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a09ec4d-a519-48ae-a84c-6c555afeeca4", "sighting_of_ref": "indicator--e93c34a3-bfef-464b-a796-b80fedb51095", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dccb2feb-7fe2-4dbe-90bc-bbe5595ecce0", "sighting_of_ref": "indicator--e93c34a3-bfef-464b-a796-b80fedb51095", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01c163ae-bbb7-4247-9ac9-a65f336250d7", "sighting_of_ref": "indicator--e93c34a3-bfef-464b-a796-b80fedb51095", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9677624-4402-4958-8b17-e66dab8ecf27", "sighting_of_ref": "indicator--26f13396-14ae-4c66-8467-142a76f0e9ad", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6257f107-faba-42e6-8e07-a68c39a6c507", "sighting_of_ref": "indicator--a9b9ee9d-ac1b-4c1c-ae83-8c710f7a55b7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96133cda-fe13-4f62-9851-a8df1c5d4bb6", "sighting_of_ref": "indicator--dbd1aa50-fae4-4cd9-9c08-db0817e56e83", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd63f748-d03d-4582-8f68-304e8ec9bd09", "sighting_of_ref": "indicator--1e2cf80c-42d4-4adc-a056-de1ec204766a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46f501cb-4343-4d81-996b-c9896615d246", "sighting_of_ref": "indicator--024fcf48-e7a9-4cda-a29f-74171fc5c25f", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2303917-7a67-46e1-a489-c3311881d289", "sighting_of_ref": "indicator--44e0ed7b-6be3-41ce-91c9-dd0bd9be866d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef98dfb1-eb93-415e-88b5-72b34ddba9d0", "sighting_of_ref": "indicator--1dfde9e8-3f2c-4578-bd40-33764370115d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c27d2dab-f8a5-481d-8e0f-a170325faba7", "sighting_of_ref": "indicator--b844dda3-1f62-40c8-8632-b7a99eaab91a", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e0c747a-5e36-4d61-b8b3-dce8ca9bfc1a", "sighting_of_ref": "indicator--c46c01d0-0a6d-4291-8b71-34f4f92149b5", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c67b41ef-ab48-498c-a785-60a9965f034f", "sighting_of_ref": "indicator--e5b944cc-cba8-4c49-93f4-6b6308b61b0d", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71c9bbea-f1cb-49b5-a4e8-878c661dd4c1", "sighting_of_ref": "indicator--1e0524e8-f9e8-4465-aad7-53e901c1cd46", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ecea4ef-c70d-4435-966e-d57f62ccdd1f", "sighting_of_ref": "indicator--8c014bcd-1c7f-4901-a84f-eb59c57b0a90", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89ff054-17c1-40d7-ab7a-c0505ce582d9", "sighting_of_ref": "indicator--b3b7f575-25a1-4e90-80c3-34ecfbd0e9cc", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c873107b-1e85-41fc-8edb-f4afb8607b29", "sighting_of_ref": "indicator--9fdbfea7-303f-4720-bcb5-ec135a4321d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b7108f-b6c5-4b2a-b2f3-3fa611f0c93b", "sighting_of_ref": "indicator--5d6df261-6f88-422c-a80f-6a02eebb0931", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c879f11a-d80e-4ec3-82d7-c3f9625b84f5", "sighting_of_ref": "indicator--ecf23346-bca5-4364-b1a6-2d47df56ee0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de73452-2b66-483b-ac5e-ee62b44ca3df", "sighting_of_ref": "indicator--535e61ca-c2ae-4e92-a5ff-0375881cfc82", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b0792c7-bf1b-4eef-8e32-b7c8acbd78e6", "sighting_of_ref": "indicator--aadf6cbd-ec09-40f7-a8cf-006fa1a27620", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eac743d3-b787-49d4-8fa7-4cccb32f9bed", "sighting_of_ref": "indicator--e661d2fb-efeb-46dc-82e4-d4074dcd7bbf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c23a11-fa7c-4ec7-acb1-f70a2e813ebb", "sighting_of_ref": "indicator--a98de438-08f4-4347-b863-5a22509acaf4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d2c4c4e-39b4-4c24-8b55-f9b3de721f80", "sighting_of_ref": "indicator--f1fe983d-a5b3-4f91-bb9c-1e0d2d67cfec", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a94329-b05a-464c-aedb-a965e087e7a8", "sighting_of_ref": "indicator--f1fe983d-a5b3-4f91-bb9c-1e0d2d67cfec", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--421ae505-1e46-402e-8fe2-6b20d912246a", "sighting_of_ref": "indicator--f1fe983d-a5b3-4f91-bb9c-1e0d2d67cfec", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c336b2d-0a89-4c34-b8da-192cff51fd37", "sighting_of_ref": "indicator--65f983b1-02c0-4dd0-b68a-e0335550422d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae577827-6158-4123-b5c7-fa76eed0358b", "sighting_of_ref": "indicator--65f983b1-02c0-4dd0-b68a-e0335550422d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eab8f3f6-484b-4bb3-8168-9b17eeeec646", "sighting_of_ref": "indicator--333044c5-e986-4f1f-8ef1-0df3fac2a88f", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ed642b-e75d-468d-84f7-2720d4df969f", "sighting_of_ref": "indicator--270c456b-a659-43a3-94c4-7b702ac6a7f2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf90422b-965c-4bfb-a068-c577467cf691", "sighting_of_ref": "indicator--270c456b-a659-43a3-94c4-7b702ac6a7f2", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4932fbe-f954-450b-a89e-d0d96d4fbf98", "sighting_of_ref": "indicator--4220d137-d6d9-41ee-8c6c-45e48807c2fc", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8adbf24-afa6-4cca-bebc-f6db8da85120", "sighting_of_ref": "indicator--60905cac-a115-45dc-8d92-20499843eef8", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48aeb7e3-e5ea-4a1b-835d-dea58da945b8", "sighting_of_ref": "indicator--4d5972ef-2bb3-4530-a5d2-95084bcda1fd", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a4513b-ce50-476a-a6ea-4838a680976e", "sighting_of_ref": "indicator--3a259e4f-1c61-4035-a66c-9d81127848a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b14f29-f32c-4076-90f0-368636233497", "sighting_of_ref": "indicator--86dcf743-7ca1-4b3b-88a2-67092bd27763", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89e37699-a24b-4a21-abf4-02930c08d881", "sighting_of_ref": "indicator--6d2f846a-98f6-4519-8a16-5546643cc66c", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abaca15f-cc3f-4443-a2f0-843abf619c78", "sighting_of_ref": "indicator--906004cd-af26-4a63-b5ce-093e2094eade", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee01fab9-bea8-4d9d-9d7f-097c0f090f9f", "sighting_of_ref": "indicator--d429a5b7-7929-4c40-a269-dda6512bb4ee", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4f5fc2d-beb6-4fec-ac68-b23156c09b46", "sighting_of_ref": "indicator--0b419a96-3d87-4fa8-9c31-51f003a9f593", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0120d9cd-e8a6-4b6a-991f-49816a2b99e5", "sighting_of_ref": "indicator--02c17991-3964-4662-8110-0aa226140436", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6808ae57-7776-4174-bb76-37e3ea675991", "sighting_of_ref": "indicator--5076e75b-e492-4cc3-b884-57709fd6e496", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb2f4955-552c-490f-869c-949f53f5d4bb", "sighting_of_ref": "indicator--57df2756-9a97-47b1-a206-374ac12a52f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91a3c0b-b9da-4d4f-b305-9600786ed678", "sighting_of_ref": "indicator--6f14ab6d-ee6f-4d08-9ba2-7c9a0a105beb", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c22c7316-29a1-45b2-ab89-69384a2af6f1", "sighting_of_ref": "indicator--3c23ca80-de49-44eb-af45-137e4de5b8c3", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac160f7-ee03-48f2-b027-25916f6de807", "sighting_of_ref": "indicator--8890ee20-06ee-41f4-bad7-aa85c484c4e4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b61e093-420e-4197-92be-8eca871528b0", "sighting_of_ref": "indicator--0ac3747c-d187-4f8a-b555-723437e6081e", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--750a4ac0-a04e-4e59-a0d5-312ccdc10970", "sighting_of_ref": "indicator--27b80304-b358-4f99-ac25-b5a206e517ec", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5268171a-6396-4bc7-b180-83f1cab4a574", "sighting_of_ref": "indicator--937eb0c9-57a4-45be-b3f9-3ca510f8b502", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e115588c-b74c-4501-98b5-70685f0a4a08", "sighting_of_ref": "indicator--c6bdd7a3-10df-4e7f-b21b-629ae97cc5a4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac14e6e-0916-4002-ae0c-8834b343dbc4", "sighting_of_ref": "indicator--e69ee093-76d6-4de9-a8a3-453ecd1e1e93", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c08365-2c00-4ab6-b9a4-78f5c1d604a4", "sighting_of_ref": "indicator--e69ee093-76d6-4de9-a8a3-453ecd1e1e93", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a11bf91e-a4a8-44ea-9167-2a75369ec3f0", "sighting_of_ref": "indicator--a52e7b31-e4d6-417e-acdd-554df5144c78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a72ab573-70fe-4138-86d5-fcf308a14e09", "sighting_of_ref": "indicator--f44ecd93-07c2-479c-8f8f-9166d466b99b", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e598aee4-ba68-4f2f-8551-bfebddad0134", "sighting_of_ref": "indicator--18cac9f3-02d9-486d-bd26-410bb02dc43a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21367b1a-7b78-4ca6-9430-423cc44823c1", "sighting_of_ref": "indicator--538a60dd-c09e-4ca4-af98-701f011e0e0b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68dd4260-8408-4d49-8be3-28b62912c677", "sighting_of_ref": "indicator--6cfedd26-2a2d-454f-a65d-f2e865d054fd", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fac7719-3b74-4033-8509-d07b61f93ea8", "sighting_of_ref": "indicator--6d74db75-38ce-4d14-ab00-b435ef168822", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644ecfd5-bd1c-46a0-ad0e-0b65da66260d", "sighting_of_ref": "indicator--3688941e-ffed-4a8e-a54c-be489f033a4a", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ca022a-b48d-4541-a318-c90f2f9a9399", "sighting_of_ref": "indicator--f06c30ea-6513-4f57-bfcd-3e8cdace1959", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c9d7451-e714-472d-8d0d-8486d62a80ce", "sighting_of_ref": "indicator--59046ab2-19de-437e-9aa9-b468aea33a86", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fce3ed8b-6010-4faa-ab48-9a53a8213db7", "sighting_of_ref": "indicator--3ea193d0-a566-45a3-9175-466453626e1f", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b97346e1-8cf1-42e5-b58a-87e35632166f", "sighting_of_ref": "indicator--33c9be58-4a9d-4893-bc9c-20ea19335255", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11488a8e-405a-4d61-8223-977c37c3b026", "sighting_of_ref": "indicator--8bb09026-f224-4f4d-afb3-f5e74a545fd6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d67ada1c-91db-4074-b9f8-b94a43b23aab", "sighting_of_ref": "indicator--467896f3-5801-46f1-b80a-4201e84eb293", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d8a54f-e22f-41bc-af7b-f1ffb750b34d", "sighting_of_ref": "indicator--699b82eb-ef7c-448d-b865-a44a59dafe07", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a7b7f3f-b16b-4af2-bc48-8f91b42cf266", "sighting_of_ref": "indicator--b87ca9f5-ed2f-453e-a0cd-2202c8cccdbb", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7788108d-c127-468d-a050-5fe36afb6428", "sighting_of_ref": "indicator--4ca75cb9-7969-45ee-8c1c-5508e3959533", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a989c6c-79f5-4928-8097-8ee449187386", "sighting_of_ref": "indicator--1f42d4bf-ee35-4b7c-9211-294c13d87f5f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65071f26-70d4-4281-b5b1-87f44f8c06f4", "sighting_of_ref": "indicator--c17ddc5c-2b38-4b5c-a5b1-5d38b3a8e67e", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90882a2-9670-4473-9767-208612c64f34", "sighting_of_ref": "indicator--d1867ad4-2a91-45c2-bd21-156c7ccef651", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--576a1775-f876-40cd-9b3f-83a704ce1420", "sighting_of_ref": "indicator--33a3fd99-c4e1-4044-8c79-902629a72609", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ffffcfc-960d-441a-acbb-7482b6eb46e2", "sighting_of_ref": "indicator--21be5903-57d1-4828-b49d-d459110fd573", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75354a35-cab4-4fa5-b56c-66c1c2e9e60e", "sighting_of_ref": "indicator--21be5903-57d1-4828-b49d-d459110fd573", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8228c2f7-547c-438c-93ab-de76602da150", "sighting_of_ref": "indicator--054a4aa5-78d0-4f9d-9814-0414efc6db26", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dc09f02-7480-483c-966e-694b58da9e75", "sighting_of_ref": "indicator--b3d4f4fd-b8a1-48d1-ab4a-f95839c4d2f0", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7df77d0-fa23-4809-aa59-3f4328f564f3", "sighting_of_ref": "indicator--00ce5022-4520-4c70-a355-f90864abfa69", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa9efc82-f1a9-44bd-af8d-e25023004b4e", "sighting_of_ref": "indicator--00ce5022-4520-4c70-a355-f90864abfa69", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a7362c-eba0-40a9-a2bd-e3138b3b6f3e", "sighting_of_ref": "indicator--00ce5022-4520-4c70-a355-f90864abfa69", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6eb9d71-f0f9-4312-9c6f-5ea07b15e344", "sighting_of_ref": "indicator--82864ff5-79e1-4d0a-aa6d-6975325e8f1c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87f8e686-21bc-41a0-893f-e44a0553d30e", "sighting_of_ref": "indicator--96092b32-e593-4ffe-ac00-e60b4c320cf2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fd2802c-fa75-40fa-8f22-9acc4cbada51", "sighting_of_ref": "indicator--d2cefd01-eba7-484b-bd09-1f453b8b2683", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--827dbe51-d651-4435-b0b9-9f96842ea9e1", "sighting_of_ref": "indicator--a2c0f85b-9e87-4c7a-a3e2-2c35dd9d8e30", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf58a3ac-ad4c-4458-87a0-d609498ee1a9", "sighting_of_ref": "indicator--b5394959-2a24-42f5-861f-0aaf9282a32e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a085dc6-a159-485b-9508-3696f277f0e2", "sighting_of_ref": "indicator--fce5d2fd-929a-4605-af88-c88db154542c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464e9f33-be2a-4b71-91af-541502db9475", "sighting_of_ref": "indicator--fb9c6753-a937-4fac-8b2e-ccf1956c339f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fefd0cc-c36e-49ad-91be-8f111a4fd817", "sighting_of_ref": "indicator--812649c4-bd06-476f-bad1-5f7e54494109", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dacc3cd-315b-4276-86c6-7dc25bd379e9", "sighting_of_ref": "indicator--f4803ffd-1323-44b5-b965-f75dcd00c5bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d948d0f-1fee-44c4-95ca-9a49b0c2c963", "sighting_of_ref": "indicator--a9c612e1-c361-415c-9401-22d7895f6879", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eae0cccc-d026-425e-9a15-23b36d7dc906", "sighting_of_ref": "indicator--f353998f-d364-4142-aa2f-0e5d0843e972", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1021d0d-b194-44d8-a0bc-332109cbf6ff", "sighting_of_ref": "indicator--ffb53644-2bb7-491e-9886-a43961d9d751", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efb89c51-43fb-4404-9f96-bf8238e60d85", "sighting_of_ref": "indicator--d48d4a5c-941c-4d45-95df-255c3398e268", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc220220-d767-4f78-8a46-2718a4193ff9", "sighting_of_ref": "indicator--40fe120e-5435-440e-8688-5a582ee95ac5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7123789-75b9-411b-941c-55b670663dcc", "sighting_of_ref": "indicator--dc278838-ee0f-4aa8-90b8-5288c2fcd02e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8d7837b-24cf-443b-bcea-cf509aa85666", "sighting_of_ref": "indicator--64954978-278f-462e-b0c0-6be7dfc9f179", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--180f5edb-e1ec-492e-8678-3c1c924c498c", "sighting_of_ref": "indicator--f6545b4b-7221-4be1-bfe7-740231be9250", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b58d55-2d44-44e8-af86-3ae6c4a916aa", "sighting_of_ref": "indicator--31960f4c-f00b-4c70-952c-73d4261f12c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--454319b9-814a-4c8b-a12f-343e93bf0815", "sighting_of_ref": "indicator--99951803-d967-4fd4-bea7-94f9e26903cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d36f0aa9-e968-4f3c-9423-23e324ace660", "sighting_of_ref": "indicator--8f194416-ebbc-4c31-83a7-851aaaff9749", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f546c883-e5b4-49b8-baaa-d577d2134823", "sighting_of_ref": "indicator--27dd8f7f-d86b-43cf-ae3b-d4cca0319509", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a683f659-b098-4da8-8086-56f14e12c767", "sighting_of_ref": "indicator--4dbb9bbb-48e3-4c0c-8245-68fe4571e596", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--563e4b7b-9860-4711-ba0e-443e695f272c", "sighting_of_ref": "indicator--604b5c28-d589-4592-8072-2fe2ddb79255", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50066108-1700-4de7-8220-80706b1feade", "sighting_of_ref": "indicator--9bd5b6b0-991b-47e8-9ae2-18727958c9a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f243023a-df42-4db2-99ae-be882a8b400b", "sighting_of_ref": "indicator--10b9b665-8a65-49fc-9b8d-6321b6c9dffc", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a056b2a3-e1f9-4eeb-9f88-8921054f5729", "sighting_of_ref": "indicator--7c3cefd6-c2ad-4bf2-bd70-18f895c74a8d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d2761ab-b417-4b53-bb03-39854ecdcc13", "sighting_of_ref": "indicator--c5585029-a4cc-4bb8-89f7-07d16ad88c49", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e98a88a8-0e51-4573-8eb3-c09f77495ed0", "sighting_of_ref": "indicator--1a37abbc-c7b4-4b4b-a55e-062d0d8a91a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4f3f4e-7911-41b2-962a-efbc643dcc0f", "sighting_of_ref": "indicator--3a722e6b-1603-4fae-96ea-22cc2e163b15", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aacd0a2b-1a5b-4174-a80c-b427576747a3", "sighting_of_ref": "indicator--0a4bdb1f-2645-49db-8df4-b3855e833adf", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da41fbe0-d1d6-45c9-b152-d4665a1341cc", "sighting_of_ref": "indicator--7c048d16-a1c3-4196-b08d-f3186e4dc984", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c569a3-0d4a-4f4e-bf90-5edae5fc0d47", "sighting_of_ref": "indicator--a130c37f-f926-439d-ac4b-c4910c9d0c39", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15151efd-a5bb-4275-93cd-6cd18c19eea3", "sighting_of_ref": "indicator--97773d75-14d4-42d7-ae52-daa46b596072", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa315d05-d6ed-4628-b1ed-b8245072b062", "sighting_of_ref": "indicator--f9c1ebf6-9918-4cab-afe3-4187b43a6f3f", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0678dc8-5ce9-49ea-bf52-6275fb4fab8f", "sighting_of_ref": "indicator--ac248aa1-7fc6-4680-a6f1-303f0eb14205", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f46de4b-8f11-421d-a3ea-9b9e17af41b1", "sighting_of_ref": "indicator--64b1d363-de23-4837-a4c4-6a333551fc22", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19db2574-829a-45e6-bed1-64b827d92783", "sighting_of_ref": "indicator--6fd2fc1a-fc77-4d45-993d-7df2b1c814f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32708163-bb76-4e68-9446-bc8f9defd459", "sighting_of_ref": "indicator--f3fc4797-5942-4be1-868f-aa5dd86982ce", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919d818c-d19e-4695-8064-6da9fb6597cf", "sighting_of_ref": "indicator--724f8a5a-707f-4b49-95e0-0bf310b196f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bdd905d-5d40-4a00-a5a2-1c7199658680", "sighting_of_ref": "indicator--2f9c2ea4-8254-4930-978f-ce1705c199ff", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--928807bb-b7ce-4fb6-969b-38f1f32023f6", "sighting_of_ref": "indicator--1e8ca32b-debd-49a5-b47e-f053aca5bd69", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e227c4a9-48a2-4301-bba8-0e3f82e1d263", "sighting_of_ref": "indicator--b8e7784e-d2e3-4c5a-bce7-d267df8d3bc1", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1820fb90-6a84-4c04-8c23-65188f7508de", "sighting_of_ref": "indicator--4320152c-00c1-4fd5-8384-6a2e120c144d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5936260a-b48b-4218-814b-c4fd18429cfc", "sighting_of_ref": "indicator--2616f5c2-8cfb-4618-8cd1-00733b8344c0", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1c06ca6-d97e-4093-8e60-d04191d58b68", "sighting_of_ref": "indicator--2616f5c2-8cfb-4618-8cd1-00733b8344c0", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60a38d56-e583-4afe-ac4a-bcceaf112900", "sighting_of_ref": "indicator--11c2ef0f-2a0b-438f-96ae-a450f0784736", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a522dd-71a3-4908-9f0b-0d4b577939aa", "sighting_of_ref": "indicator--3973731e-041e-4726-83f2-a321611482c7", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b418a5e5-50a1-4085-8b44-ef032cd47c36", "sighting_of_ref": "indicator--3973731e-041e-4726-83f2-a321611482c7", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1fdd0f9-ad91-4b35-a59c-b5f51579f54d", "sighting_of_ref": "indicator--77f4d98f-40cf-445d-b143-253456991c53", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bea4bc6-5dc5-4ecb-9259-29f0019f9f06", "sighting_of_ref": "indicator--22a7e53e-a3f5-4bcf-bef4-2be4a02d3a46", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e0f2931-f6e4-40b7-8ade-d14a5a7c3530", "sighting_of_ref": "indicator--2c5b8f36-42c3-4952-b31a-2b5a93aac7a1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c32318-2d54-4d78-b458-b68c0566889c", "sighting_of_ref": "indicator--eead6b69-f317-4507-bbd2-57e1f60f749f", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--002ce3cb-5745-4274-a555-4d569d18ab7e", "sighting_of_ref": "indicator--b9839972-b6d9-4185-b1e5-91cfa4218e24", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--316bdfc8-d1e9-47ba-a384-5180220efd5e", "sighting_of_ref": "indicator--0044cf50-92a3-4489-9f43-9c7aea38ab82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--806c1b6a-1b71-473e-9270-f28ab2c18197", "sighting_of_ref": "indicator--9d0ab421-43d1-41e6-a07f-6a9a28a63bc9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33adf68d-e65c-4ec4-a4d7-f7d9f87c26b9", "sighting_of_ref": "indicator--7c9a0252-c1a1-4c29-80cd-da5bccc56421", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54484add-71b1-485d-99ac-dd9c2d53ec95", "sighting_of_ref": "indicator--fcf6ee32-ae56-4886-878c-42ae915fe607", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1458e8ea-ac03-4d10-bd6b-7fe2b4a8f7d7", "sighting_of_ref": "indicator--8481c46f-93ab-44df-85a2-b117e33ac169", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b6f2ed-2e00-4b69-8197-648cb666b548", "sighting_of_ref": "indicator--bdf36118-be0f-431d-b2de-fed5d7ab8497", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58ef4dd4-8c1c-4d20-bc26-b9be3c57bc98", "sighting_of_ref": "indicator--e545a26a-93ca-47c8-aefd-7f8fa66cb01f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e34600c4-7496-4721-9eb7-90b423c806bc", "sighting_of_ref": "indicator--740a8c29-f2d3-4bb2-8b5e-280a8e3f0839", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2979a329-4777-4ff9-ab09-24c3a5ed5d88", "sighting_of_ref": "indicator--d1ceea4c-c9c1-4b16-a9d5-a1eb83e5e268", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7064672e-0924-4bde-b151-4fb6ea14c12f", "sighting_of_ref": "indicator--ce53dc50-11d7-44d3-b729-39c6b3747d98", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c47a4f2-5166-4787-9a2d-c1d866b72794", "sighting_of_ref": "indicator--ff3dfef1-6466-4dea-acd8-5b743c83cf99", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b388f59-9a60-4d47-8fa4-437e41d5ef7e", "sighting_of_ref": "indicator--3ea271bc-e51c-4b45-b695-b88ba7d38250", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfc7d4b8-7688-491b-8d45-3a5348cf65d0", "sighting_of_ref": "indicator--a5cd4fc1-87bf-4e6f-b7be-994fe7a32ba2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e7791f9-df4d-4197-b31d-49acea0390b9", "sighting_of_ref": "indicator--3d28ac2f-bc0a-4a7a-862d-3dd523358ba7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--694e1e53-0ddc-49e4-b183-c177f0d54622", "sighting_of_ref": "indicator--9d0b0274-1d28-4202-8292-a5454baef96c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6fe7039-316f-4a13-b340-e6700e4c3526", "sighting_of_ref": "indicator--4e3a7302-8770-4d5f-8574-5164dea87921", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3e746d3-d61e-4998-a814-cb8c5a5f59cc", "sighting_of_ref": "indicator--b0193842-78e6-4489-86d7-c1956862af6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3bfa145-044d-4982-b364-5744d131c751", "sighting_of_ref": "indicator--922d296d-f625-46b4-a2d9-976562a1088b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e03960d6-93b9-46b5-a708-737ae7547e19", "sighting_of_ref": "indicator--62065d3e-018c-4c19-b276-ff53aa5ef3e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df4a00b5-e5ff-496d-ae21-b2fc7f3d6e6f", "sighting_of_ref": "indicator--a190b905-c340-4e12-b358-fdd5341bd3fb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e7d74a-f5cc-4828-9223-dc6cdca0578c", "sighting_of_ref": "indicator--35ba45e3-dfd1-44d0-a641-b8668e18c595", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2933b212-6f05-42ac-aeae-07268a75c8d8", "sighting_of_ref": "indicator--f01e66f8-05ea-4617-a150-bdf79dfe8cf1", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--838373f0-ecd1-49f7-843d-1c9b38d3c5c0", "sighting_of_ref": "indicator--827f32a3-1ef7-44c9-a346-8cba2d71b72e", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b291036-2066-4bce-89a1-d27ec6b86a00", "sighting_of_ref": "indicator--5246d6ec-40e4-453c-be93-6a4d8e42a300", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcfade85-3314-4362-a7e5-00ec7ff4b068", "sighting_of_ref": "indicator--67fe9f14-6a4c-4688-8671-9809bd071163", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70117dd5-5b34-4c46-a1f7-b5649f5c6508", "sighting_of_ref": "indicator--67fe9f14-6a4c-4688-8671-9809bd071163", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecef8b88-908b-4448-ab96-c7f229552bc7", "sighting_of_ref": "indicator--4494a5d1-4a1f-49f3-8189-44a9ffed53e1", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29b8c0a5-0cea-45e4-8a18-d0e365b9fbd0", "sighting_of_ref": "indicator--4494a5d1-4a1f-49f3-8189-44a9ffed53e1", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae7f7bb-8891-4358-bff0-eca885a0628d", "sighting_of_ref": "indicator--4494a5d1-4a1f-49f3-8189-44a9ffed53e1", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24304b2c-d9de-44ac-b4dc-9650d69ed4cc", "sighting_of_ref": "indicator--b793bccb-df43-47ec-8e43-9cc4516f04a2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95b7087c-ab58-4ef5-b25d-76de9ae17634", "sighting_of_ref": "indicator--b793bccb-df43-47ec-8e43-9cc4516f04a2", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--872cc1d5-84d8-4fd6-863e-d6022914a1c4", "sighting_of_ref": "indicator--f7c447e3-af9d-4564-ab01-e2ab4535392d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2066721-9766-43ee-8ab9-3bd5c35af6fb", "sighting_of_ref": "indicator--4079266e-1e7d-440a-8ba0-43f7ef3ed43a", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a424f40-3639-4a03-a6a6-50c648156a42", "sighting_of_ref": "indicator--91da1293-112b-4d57-a519-000042d19af9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e70f29ca-c7cd-40cb-bea7-e1b9a753c602", "sighting_of_ref": "indicator--ae0fbe1d-2132-4e0e-9994-e9f5aefa159b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f1334f-c1b9-43e5-a06b-d9e1590ece34", "sighting_of_ref": "indicator--44eda4e7-4571-4c37-b054-efe1ba432235", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9159e4e0-87f7-435c-b63d-998588e1ec3f", "sighting_of_ref": "indicator--ed7569bc-18bb-46fd-8744-01a9adce5e96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52a1431-9960-44fe-b613-f1750612b91c", "sighting_of_ref": "indicator--5b85cc5f-ac02-4ba3-9f6b-c89f36b59a6a", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03c75b78-1e57-4bc5-a98c-6523a9bc1e4d", "sighting_of_ref": "indicator--d56165ca-cd8c-43f1-bf42-988801f5e970", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f26e43e8-7d27-41cf-83c0-35871f087a6c", "sighting_of_ref": "indicator--54cfeed5-dd6d-474f-9830-f2a53f4f9f17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2c7aa30-2210-4386-86ee-d1b1d790ab8b", "sighting_of_ref": "indicator--a9ab8a5d-cdcb-4749-8dc5-fc758809f5df", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--806da9fe-ea7d-4d14-90b2-191faf3ec4c3", "sighting_of_ref": "indicator--d04b1f5b-9f30-4bee-9d64-9699636600dd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c26f2cc7-7ad1-4769-858b-db4a2456f593", "sighting_of_ref": "indicator--d1b5b98d-8ca7-499c-952d-a1b424ef2446", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c530b79a-f5d2-4305-92eb-4a4d9228171b", "sighting_of_ref": "indicator--dc97a9e4-106c-47f0-bec5-dd596103f697", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be00af6-3569-4730-908c-ef40a4f13c14", "sighting_of_ref": "indicator--de3afb64-8d5c-4e50-b16d-7db8f423ede5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d648700c-987f-4eff-bdcf-6f22e63fbc11", "sighting_of_ref": "indicator--5927a9c2-1f16-4582-95bc-97f7b6ae18ca", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50cd387-f5c4-4dea-b1bb-a59cfdb28b5d", "sighting_of_ref": "indicator--d5a135f5-4f79-48c2-b138-e45e6304530f", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d906212d-4036-4b9c-b2fd-d0613c84332c", "sighting_of_ref": "indicator--40027931-19a5-4a28-a3a4-a09fd1472642", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f4bb04-f547-4e31-8667-175d6c5cd63c", "sighting_of_ref": "indicator--7a39ddf1-afb9-4fe3-b02a-54da0be995f9", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbff627f-2a84-4136-a720-a617db862ca3", "sighting_of_ref": "indicator--e84842a1-6278-44ae-9218-a73d147fe5bf", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a28374-03ce-4c1b-979c-c2fe80a459d2", "sighting_of_ref": "indicator--302f2511-267e-41e2-accf-b0c43cc9da9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d155223b-ac7d-4dc2-a167-19dd1b1c1118", "sighting_of_ref": "indicator--492226d0-0785-49fc-a792-8bf3281152a2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71e828d1-a7a3-4594-b32c-96e9cb487c8c", "sighting_of_ref": "indicator--56b3cedb-ba17-49d0-b11a-930794db91a8", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6315f67-75ef-465d-9f58-ddbe41fb6699", "sighting_of_ref": "indicator--5c3ef66d-a78d-4b07-87d2-d367eea54060", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f71d807b-a96b-4af0-98e7-a792416a2a23", "sighting_of_ref": "indicator--e23bd824-72c6-4932-9d41-87e595bc7898", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f33a053f-427b-41cb-b5ae-264c1d458c3e", "sighting_of_ref": "indicator--401af01f-897d-401f-a14b-6f0ac60db301", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfee932d-1d2c-4d40-ac8c-c9fcffe56f16", "sighting_of_ref": "indicator--2172f6c6-6580-4386-9f79-ac4b5f7c4b33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8cfaf15-dfe9-4540-9b79-6017c81c4b44", "sighting_of_ref": "indicator--fdfa6f99-ab1e-48a5-84fe-4f82944d76a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd8ff7c7-1d85-4a38-b6fe-33f98f6fead9", "sighting_of_ref": "indicator--08706cb1-650e-4236-9e90-e0f6a2b530ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7a74db0-cde7-43bd-b1bb-1f34acd2e700", "sighting_of_ref": "indicator--86dde5fd-5a77-4f9e-a3d5-9c89751161de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34a545a9-13cc-4d9f-bb8e-60e79c9ce317", "sighting_of_ref": "indicator--8e51639a-19ec-4907-ac06-0decabdd19c6", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef48b280-247f-4e90-a9a9-5ccc8e5f2608", "sighting_of_ref": "indicator--a6fe6265-6c3e-4b2d-a2a1-c6ee21a6d6a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955d5b00-a081-4634-8347-a19c7129b4ef", "sighting_of_ref": "indicator--cdcaf870-6baf-43df-a0d1-7d72311c0728", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d9faa0-46a5-4c74-9ed6-2d0cc985b16e", "sighting_of_ref": "indicator--cdcaf870-6baf-43df-a0d1-7d72311c0728", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d4d00f2-5e6d-4bd0-9b32-b066b983218b", "sighting_of_ref": "indicator--2e12bcec-5c2c-4951-bca0-9a1f9a4d79c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf6b4b9-a7e5-4010-9bcd-6d2a1096b21e", "sighting_of_ref": "indicator--01cf12fa-8239-4aac-b13d-0ce887ef3614", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dfecc6c-1264-42b2-ae93-91df5c83c348", "sighting_of_ref": "indicator--857b1d0c-219e-4464-a9f7-5f3bb519026b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53916eab-67b6-4cd0-96cc-69bd0b9d2811", "sighting_of_ref": "indicator--5eb6bdb4-0406-44fb-ab84-59c3464d2a9f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9c65ef2-dcab-4855-9045-64ac216aba8c", "sighting_of_ref": "indicator--fb3758c8-2376-49c2-abe4-f6fcff2a9b32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bbf5d0a-6be5-4cc1-9601-b4eadf88c704", "sighting_of_ref": "indicator--592d09be-16d1-4a5c-8bb9-c414233dc9b7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b393c2-f4ff-41bd-a336-914c0cc35711", "sighting_of_ref": "indicator--ec56938f-3c2b-4e34-b688-dad591439b09", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e0a61fd-3c6d-40a7-bc6f-1324afe979be", "sighting_of_ref": "indicator--cb85acca-e023-4337-a118-247e2f78cda1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8363aeb9-b144-4d07-8cf0-612468f66c1e", "sighting_of_ref": "indicator--c4568a56-828c-4ede-8f4a-19d44dbe92f3", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--718d9b33-d9ad-4ee1-a559-e4841eb2aafb", "sighting_of_ref": "indicator--c4568a56-828c-4ede-8f4a-19d44dbe92f3", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b838825d-4d5a-4e2c-b92d-b15577f1ce69", "sighting_of_ref": "indicator--6df30506-aaf2-449b-91b6-b316eaf2809d", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5871fb9-a674-4690-ae91-277cedf8b612", "sighting_of_ref": "indicator--11025c08-5d35-4643-9b5d-0ca280ebac8d", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8ffd13-e7a6-4804-b492-7f499bfb0822", "sighting_of_ref": "indicator--8cd7c6da-bbd4-4aa4-bc4e-843e6f3e7509", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25b5002c-cf50-494e-994a-95a45ccacced", "sighting_of_ref": "indicator--37c57240-ce3d-4fdc-bcbc-0211f02bcdeb", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40e6616f-d45c-446f-bc41-61bb1a9ef8ce", "sighting_of_ref": "indicator--c1fcebab-f26a-4cdf-9ac8-d47be35ab185", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6810739-28b1-4e13-922c-42904a0cc84e", "sighting_of_ref": "indicator--64d6e251-ccf8-455e-8430-1af75a5eb3f8", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf706848-0d75-45b7-b8ca-94f4a0c94552", "sighting_of_ref": "indicator--26b0d164-0802-4bcb-b7d6-c74f37ff8d5a", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c76d09ce-eed3-4981-a6e0-124639c7d6c0", "sighting_of_ref": "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f923549a-2f2c-48c0-a0e4-8e86c1280ad9", "sighting_of_ref": "indicator--6d5f6592-b749-4052-b07e-616159074f10", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66aba77-0044-4994-9629-4047b7f9ae52", "sighting_of_ref": "indicator--fd140337-8634-4e8f-8667-66e832be8376", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94865239-d864-44ce-a642-d2c7cd731c40", "sighting_of_ref": "indicator--55545ad2-a967-4281-a19a-9ae776bc9f94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60405467-a0f9-4ace-a809-3e42266543f9", "sighting_of_ref": "indicator--77a195c7-589a-41c4-bdec-7f92501e4e9c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a617c758-e08f-458e-ad73-b596dcf61e67", "sighting_of_ref": "indicator--f121f310-79d8-4dbe-8022-40d810dcf589", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39c38276-4f19-4389-ba26-083ff9b76e80", "sighting_of_ref": "indicator--f121f310-79d8-4dbe-8022-40d810dcf589", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f8712c-ee71-4359-9b19-1324de8d44e8", "sighting_of_ref": "indicator--f4d1ab55-7418-4227-9f0d-d41e9977334a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0bfc387-b84f-46f7-becb-6d5c54c764ae", "sighting_of_ref": "indicator--a984f8fc-4453-4a25-84c8-cf71df7f8708", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed717189-9359-4515-b713-83d831538199", "sighting_of_ref": "indicator--ba564948-8902-49d3-83da-0b6b67f4e985", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--244a6bf2-3cd6-4c85-ba27-0260e42c2f70", "sighting_of_ref": "indicator--74c34f74-14b9-4cf4-a772-ece15d554b69", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--731b04d2-c231-4e25-9f76-87c7d548ba8b", "sighting_of_ref": "indicator--077b5bd3-a27d-4f56-a2fe-c39442c61300", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b62e1fa8-4333-4c92-98f0-c053a568c6bc", "sighting_of_ref": "indicator--e9c0a34e-09bd-43d8-850b-157ef91d8573", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e885b8ff-fff7-4983-8d3f-205208e72f4b", "sighting_of_ref": "indicator--f05040e3-54ca-4012-9430-2fed23a5563e", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdcf6ff1-e2a0-490e-a5c7-c871aa2d330e", "sighting_of_ref": "indicator--725ee357-732c-4ce9-b7b7-4e1c6dad3b0e", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a87c3df6-8950-4933-9827-9b1482e5e68a", "sighting_of_ref": "indicator--f3d164c8-9b6c-45de-a788-0ac180211115", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fcfac89-c8c1-4598-a59d-91494c21a0de", "sighting_of_ref": "indicator--3a630703-79ff-418f-8028-168009fdb49e", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77538aa7-1d18-4a68-8c1d-1beda86ca34b", "sighting_of_ref": "indicator--c71db7fb-4741-45ea-8c0f-6f21c3da4863", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0debe42f-9a94-4ac3-ad7a-38cb75b66636", "sighting_of_ref": "indicator--e4f53709-e4ef-4623-acd6-d27898ad5a36", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47db0c39-ecfd-4c9a-9954-983e84afa512", "sighting_of_ref": "indicator--c221b732-a538-4532-87fa-21ba3637540a", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b64367-a9c1-4122-8a25-7e96ad5a8dab", "sighting_of_ref": "indicator--72a2ce36-8470-4b91-b6d7-3b27780c85b7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--129298fa-188d-4790-88ee-d97099c35c4e", "sighting_of_ref": "indicator--3aa0a558-15ff-4a07-88ec-3189760a3057", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eef6cbb-8193-4ca1-b879-ad706b23cd71", "sighting_of_ref": "indicator--32f8fc85-f5d1-4dd8-b10a-a3151b4970bd", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e5cc30-fd36-47b1-8637-cee71078a285", "sighting_of_ref": "indicator--0f05e176-c0ce-4ca7-bcd5-32bba84c5ab8", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--175f9145-7cd2-4802-a357-d0d4543eefd6", "sighting_of_ref": "indicator--0b24e536-e66b-453a-bf43-8266d9907828", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec7d9c78-7e1d-4e1f-a8ac-146ebf4a4f75", "sighting_of_ref": "indicator--e3a444c9-51d1-466c-81ec-da07f3f069bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdb394c3-55b4-422a-a772-d5be0a2ef06f", "sighting_of_ref": "indicator--87529c79-eb8f-42eb-b302-9cd9f8ace564", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76788464-55e2-4845-bba1-a20ebcb42cf9", "sighting_of_ref": "indicator--e3e57821-95db-4d38-b1aa-3e4b445af29c", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b1c8761-1515-4783-bffe-01124cc6960c", "sighting_of_ref": "indicator--14d29567-1d9f-46d8-8ed0-cde37c211c24", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f166aab0-bb4e-495c-9096-c0c0869ba371", "sighting_of_ref": "indicator--f22d1814-9e9f-4866-be7b-b8e7cd8efb02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fdd9013-bd97-4674-9ea4-ab8ddc8c1700", "sighting_of_ref": "indicator--48c02b65-7586-4d9b-8694-e40370ea177f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dc8f9f4-c48f-4767-a397-c21a2109312c", "sighting_of_ref": "indicator--ba5e1747-96b1-4f96-9170-cfe62bbc50c4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--351f4fb0-8e83-4a80-8ef6-643c203407b7", "sighting_of_ref": "indicator--f8420ad6-8ad7-49d0-856c-fecc94c109a7", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc9abcd6-b26d-4c03-b26a-bcc1a681f287", "sighting_of_ref": "indicator--729881ce-23d9-47d4-9df1-e713d641a324", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--005e7733-8ace-460b-a3d5-1373634c6d3f", "sighting_of_ref": "indicator--241dc9cb-a978-4bbf-a70a-77abb59b662e", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95621c87-8d73-4d53-97a0-00f5daffdd1c", "sighting_of_ref": "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1766ee89-d3d1-49bd-ab8f-a63955cc9986", "sighting_of_ref": "indicator--42919588-762e-4e75-9727-c04fcb3a7019", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--211ba1f2-214b-4198-8a3c-d116d1fa47bf", "sighting_of_ref": "indicator--925f73a3-7cf1-413a-9d98-6bd2ccc17fa0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63ba01bd-47f5-4db8-b1c2-81b4451c368f", "sighting_of_ref": "indicator--4309eef1-319f-4ef2-acec-4d17651ec24a", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87762da4-9b25-41c4-8e37-5bfd4e462c69", "sighting_of_ref": "indicator--3fc0ccf3-7eed-4ebc-9e80-9a360856b1e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01b7ff81-4bb0-4933-8887-df71eda622a3", "sighting_of_ref": "indicator--7dbcae89-11c3-4dfa-a4f4-361129b4659b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410ae20a-4533-45fe-8f4e-47cdd9be8075", "sighting_of_ref": "indicator--f86b517c-58de-45cb-9f5e-dd6c451756b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75de90dc-fbaa-4628-b736-fd1d06581d7e", "sighting_of_ref": "indicator--f86b517c-58de-45cb-9f5e-dd6c451756b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93519977-8a1a-4326-ae4a-bcfa01ae5e68", "sighting_of_ref": "indicator--b3b0fb6e-2d7d-4734-8587-124be26619b7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1e41b9-d4b0-4447-b176-00fd92d287dd", "sighting_of_ref": "indicator--3dcc7750-fe81-4c00-8e0f-ca9a0afcbb88", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f3764bb-3d92-4e4e-8219-695df1057f31", "sighting_of_ref": "indicator--a335c040-0ea1-457e-abf6-71a73628acb4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65e635ab-993b-4382-97c7-8e3ac06bb56e", "sighting_of_ref": "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4f707b-f086-4ed1-b59a-0374ce3101ca", "sighting_of_ref": "indicator--17bd7a88-c828-4030-83bc-162cc2ac78df", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cecc57c6-a607-4328-8bba-1fb146e09605", "sighting_of_ref": "indicator--36c817e4-5689-4421-a3b3-557d70e79e4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9ca0bb8-f740-4cf1-a2e4-49f4820bd2bc", "sighting_of_ref": "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b164eed-ef20-4216-9c3e-00100663e942", "sighting_of_ref": "indicator--2e1016b9-9e9f-42db-ba43-1becc7c6f408", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe076be-54cf-4666-acb6-9f02a6df627b", "sighting_of_ref": "indicator--bbecfda7-96cd-4068-ac66-52ac3ecb5d35", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b27e8e66-a9c0-433c-935f-f2d341e403b9", "sighting_of_ref": "indicator--c30aefd1-a1e4-4597-805f-c489aff5394f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59aaf220-0261-4b4f-ac93-e62aa24260bd", "sighting_of_ref": "indicator--a73f6877-7dfd-4475-a321-34998d27d2d6", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bec803a1-35d9-4f0a-bcfb-c513ce3c0fec", "sighting_of_ref": "indicator--f13aa69c-7222-4de7-a4f6-36c4d4575ce8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc7b7d8-f3ab-4ce5-86b7-ca3f36ee4cfd", "sighting_of_ref": "indicator--a153a7a8-0209-4bff-b5a8-48bfa4c8e4a2", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c3ff82-01b5-45fe-b0cd-005855e01c2f", "sighting_of_ref": "indicator--a2f686a2-b6b6-486e-a0d2-dcf109a322e6", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bff4496-20c4-42c7-85cc-7aab504e5bf6", "sighting_of_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b3b7211-e277-457e-9a9b-9205ac2252fd", "sighting_of_ref": "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28fc882-7e7b-4485-b3c7-2e214edf1a8f", "sighting_of_ref": "indicator--f012d293-9e5e-4354-b456-2406e036d976", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02321188-a436-4b05-88d5-3d9ee2651dc4", "sighting_of_ref": "indicator--0599354f-5ac0-4a79-823f-9a2622205f72", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2134b94d-6539-4914-aef1-14072f1f9b16", "sighting_of_ref": "indicator--9bbb6038-2af1-4ed8-88e3-1f8555ce1875", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffcd7920-9d74-4881-bd26-ce6d32d82a01", "sighting_of_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506f81b1-8a89-4cb8-964a-5929041c4a14", "sighting_of_ref": "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bba5fca5-3a03-411f-be00-652d971b6ef2", "sighting_of_ref": "indicator--6a767edf-b470-44b2-b032-5c26243300c0", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--497e3cde-6083-4815-b8f2-65dc27c78a9b", "sighting_of_ref": "indicator--50d70d5e-a9f8-4ceb-998f-b89e75088deb", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c263dd5f-b068-4bb1-b1fb-b65743f6932c", "sighting_of_ref": "indicator--dd5b3a8d-52df-4602-918c-f447cc0bbbf5", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064e165d-0971-4f04-be5e-712b69ca7e4c", "sighting_of_ref": "indicator--ee8e40b1-4dff-46dc-b558-146f4f2e8122", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56bacd80-9bfa-4043-b92b-500dbb5e9acc", "sighting_of_ref": "indicator--f1f2af93-1148-42d9-805e-ac9320e714e0", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54612986-52b8-4432-9786-dc35042b35ec", "sighting_of_ref": "indicator--6d0bdb7e-175a-4bdb-9e66-10bc639519f4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42fa5c90-009a-4356-beea-ec371d013e8a", "sighting_of_ref": "indicator--1c33bcfc-fff3-41c9-ae85-9e3f8fc879fc", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3843a99d-05a8-467f-a8b2-e2594d30e1fa", "sighting_of_ref": "indicator--a35541f4-0467-4377-8bff-11bf7cfdb455", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1b1d136-e721-4de8-be0b-744e073cfb54", "sighting_of_ref": "indicator--909b4c84-80c2-4573-8aba-173ca3a33984", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b792599d-036d-4246-9e01-2f5789d1eb4e", "sighting_of_ref": "indicator--8728bc01-eaeb-43e1-a488-6cc15a22f5b1", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f59b7f1-b7ed-41c9-9116-7c466a35f0ab", "sighting_of_ref": "indicator--661c5c44-6f89-42fa-8aaf-a52ea7db2be8", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef7f9975-728f-4e46-9815-dd2a4beb8996", "sighting_of_ref": "indicator--de021dda-b388-4cd5-a2ed-32ab88b16587", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1240fd18-d9e2-4f21-b1f0-178743d6e999", "sighting_of_ref": "indicator--f3118753-e93c-4289-8c29-34d7fd9cbec7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d34ae61a-fcf7-467b-b8a4-45621df4a9dc", "sighting_of_ref": "indicator--a7994d73-7aa9-4b60-a452-1c315d510e6e", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70332228-537a-4c0b-b7ca-50441e510317", "sighting_of_ref": "indicator--f09ecd30-9a5c-45da-8f68-4d0f4bd576fa", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4166557b-da5d-4447-a6da-0eb92ce8c31c", "sighting_of_ref": "indicator--fa60d159-003e-486f-97be-d786890c231a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f90141d-0cf4-4119-9e0f-c5187f161c1d", "sighting_of_ref": "indicator--5ad4dbb0-c18c-4bb3-805f-db42abbe8102", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d215971f-accb-45d9-9c35-1138e96aced1", "sighting_of_ref": "indicator--067e2167-b656-4fb4-a6c4-eea168f14f8f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ed07789-f625-48a8-8a77-35bcf80911e2", "sighting_of_ref": "indicator--1b80b4b9-0771-49dc-8ed9-e9f20b272f45", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f393bb1d-a321-43d5-aa70-7151a10dccb0", "sighting_of_ref": "indicator--96d82c7e-8f81-4068-8091-d72116c60063", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b677811a-9712-4a59-b917-99ab72b929d6", "sighting_of_ref": "indicator--96d82c7e-8f81-4068-8091-d72116c60063", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56913a42-bdf1-40b1-99a1-7c15a5da0aa8", "sighting_of_ref": "indicator--96d82c7e-8f81-4068-8091-d72116c60063", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b893c6a5-852f-4c39-b2c2-a1ad72fe164f", "sighting_of_ref": "indicator--f555d81a-0950-4960-8683-88e5178ce1d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2705f10d-1bf7-4814-bb6f-f3a1981e8076", "sighting_of_ref": "indicator--15603be3-d8ec-4e57-a451-84d30331ffaa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b81229-8acf-47ea-8455-9b9ee8dbc990", "sighting_of_ref": "indicator--22e084ba-23b5-422e-8b91-4dff775e1f08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb7f4b1-420b-46f7-aa09-edf4ee59eb17", "sighting_of_ref": "indicator--68ed6345-85da-4572-bbb5-5f83250e2cb3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aaaac12-de1f-4681-a9c1-19240cc27e0d", "sighting_of_ref": "indicator--7fe7aac2-38df-475b-a326-e9c932ba37e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20232728-c97c-4d9b-b8e3-80ee01de09e9", "sighting_of_ref": "indicator--30147632-3c09-418e-9217-36e0ca73d29c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de001683-522a-4d69-a951-2470ac6d3186", "sighting_of_ref": "indicator--a5c2da55-53b0-46c9-b93d-f990f94171f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac4dc5e-e906-45f5-9893-bb9ca5e8842f", "sighting_of_ref": "indicator--05dcf205-df78-4989-ae4a-b6b581d4f67a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19376ed2-1fae-43db-9648-9dc65b0ab24c", "sighting_of_ref": "indicator--7e70ee3d-0c0c-4525-a968-8c05a11a5379", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26897515-f19e-44c3-b134-973476aeb46c", "sighting_of_ref": "indicator--1a942933-1d23-45ef-9ea3-32dcd50b40a0", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30ac76a0-3032-4efa-bc56-51249b82c250", "sighting_of_ref": "indicator--5020469f-0a03-4ac7-b348-86b7f1bac8cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39be3e5c-179c-4b1b-8bdb-c8273a54b732", "sighting_of_ref": "indicator--d234d4c2-81fb-45c6-a356-674a667369b0", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b8c580-0991-4f4d-9d89-2335818e32e5", "sighting_of_ref": "indicator--0e6b999b-1ccc-43c7-919e-e6cc67214b91", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee3423a3-76ca-44ca-83c0-e1f061b8c7b6", "sighting_of_ref": "indicator--86533ed6-9484-46f2-9493-e538ad4b9586", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6558d40f-fd82-4569-926f-1bae5c288fbb", "sighting_of_ref": "indicator--7821d584-897b-477a-b2aa-7c2ee560e3fa", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7ceb123-95cb-40bf-9aec-b9f28dc47e28", "sighting_of_ref": "indicator--0d16d738-b10e-47db-ba53-0f92790550cb", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cee35f02-f7da-436d-87ee-9867dfb70dde", "sighting_of_ref": "indicator--a91c9e21-864e-46b2-b734-d213cfd734f2", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64542338-31f5-440b-91a7-f25af158ae9a", "sighting_of_ref": "indicator--6d9aba84-dd95-4516-a395-bf2b88b2cceb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa35a55-5376-44d8-8654-ab3cdd7d1aba", "sighting_of_ref": "indicator--7fa19dac-117a-44e6-ad75-9bf5c68f70e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--234bc202-8770-4a51-9fd8-a2f58bec2728", "sighting_of_ref": "indicator--6601446c-81a3-47db-8c85-c31915a5c0f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d21f5b-2b7b-4d7f-92bb-271b9da31fe2", "sighting_of_ref": "indicator--3a35ef9a-8e90-40e6-badc-47d639e18aec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf625a5-0d31-4d8c-b34c-6eb1d43c3bb4", "sighting_of_ref": "indicator--8e1de570-a4ee-4fac-9602-8bdb7eb477c7", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b990b865-5d55-4537-8a26-3ad9313c915d", "sighting_of_ref": "indicator--36b77884-8114-4256-be6f-1efb660c2bb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--addbae40-a432-4ab0-823a-eedc35d8ea1c", "sighting_of_ref": "indicator--d4777544-4c90-4365-b2ce-5cd922cd7758", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fbbb0d1-31d8-42b9-aa48-c7eb934ff767", "sighting_of_ref": "indicator--b04586d2-a64b-44e3-a2d0-9586b8da2b57", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4480b7c-6d12-427d-8c43-3265a1232e98", "sighting_of_ref": "indicator--8b5084ee-f930-48c2-8d55-76274cb8192d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ee41f57-920b-4961-a652-521ee32d09e2", "sighting_of_ref": "indicator--af230f8f-400d-4820-a4b2-71b36805ffbd", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17680de4-a02a-47c1-b663-d0880cbee49a", "sighting_of_ref": "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f2aec8b-2423-4642-9241-d50162841e7b", "sighting_of_ref": "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0b0bf6-5803-412b-b9ce-9b0939d954ad", "sighting_of_ref": "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24a0c910-d4f2-4b8c-91a9-3e7de0e8cf06", "sighting_of_ref": "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b543b493-b08f-4856-9310-db98d735ca3f", "sighting_of_ref": "indicator--4e668044-abb6-4304-86af-82762fba0bf3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62f69561-21aa-40c8-af0a-4fd29c3a154d", "sighting_of_ref": "indicator--42ce6b9b-acb6-4fd4-95d7-39292af6eedb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246c0899-ecce-47b4-ae57-31b0bcd0c9f6", "sighting_of_ref": "indicator--660ee482-eb8e-40c8-ab3b-9af33e7f6fe0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cc00b6c-839b-49db-8c2b-6833321fd79e", "sighting_of_ref": "indicator--0d767142-04d3-4283-8886-9cdddd7bdbe6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--161f9ca6-6b33-44b9-ac3f-df2992809c55", "sighting_of_ref": "indicator--463c381f-bee3-406c-825d-7a435d3afe1a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09fade93-9a49-4210-8527-7b5a367366a4", "sighting_of_ref": "indicator--690dadd1-0b2e-4ca5-8c7e-2841c88b3830", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80bdd1a-36f5-4a46-aafc-54c434074d2d", "sighting_of_ref": "indicator--481a85be-3494-4f3d-9946-fbab10df8340", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1804ef7-7732-4905-b8b3-d8924a8df722", "sighting_of_ref": "indicator--3aa64438-9411-4d3a-803d-9a9c9e1192cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd02b99-1946-4af3-85b0-2b87bd9f5061", "sighting_of_ref": "indicator--b1664202-c068-45e2-b783-b0c8dab55c5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a0460c-8dfa-4492-8315-95d964c7e9a5", "sighting_of_ref": "indicator--f207241d-e160-4066-83f1-5f909db508c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--390e7aea-2553-4e06-9fb1-a14bd5e9d689", "sighting_of_ref": "indicator--35729941-6854-43c6-82fb-7a94b877e7b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52a7d7b-213d-4617-8c5e-a065b8ed6423", "sighting_of_ref": "indicator--f1d963d2-0819-4861-ab42-555d0be5ccb9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--078ada26-2110-4e75-83d0-2108a1645ac7", "sighting_of_ref": "indicator--f5f227df-7fb0-446d-bd9b-274c4a71a432", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17dd138f-59f4-4dc5-9c0f-3cfa3f82d532", "sighting_of_ref": "indicator--d7d4eed0-ebcd-4f9f-89bc-e20857141e4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c65545d3-d332-4176-ad1a-2214acc970c7", "sighting_of_ref": "indicator--ceeac1d5-41fe-4f0b-8ace-0d0946bc4995", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--471873c7-f2db-47d2-9c26-236fb80e7fd5", "sighting_of_ref": "indicator--f2a74139-ec3d-44e9-87d5-315cc69dbd65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cceacd3-6921-48e1-a38f-ba21833e43ed", "sighting_of_ref": "indicator--949df8a2-6f8d-46e5-8c87-b442a2bdde1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c36b84-2c6a-4ba6-a581-c7963921d049", "sighting_of_ref": "indicator--395d5823-c71c-49bf-a535-b8a2ac03dd2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--826b4b04-293f-41d5-8d4d-db4aa3c9c8ba", "sighting_of_ref": "indicator--a522a541-a598-4366-bd5c-285d701f53d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae9eb0b-055b-4c8b-8357-6f07c2ee413c", "sighting_of_ref": "indicator--99e10663-dec9-4812-85a7-d9398e281998", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6713ee4-6485-4bbb-bfeb-68a434bfd995", "sighting_of_ref": "indicator--f4bb8c89-eb06-455b-907a-6ac4f2992242", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b447df-210a-4489-a144-f4270e330205", "sighting_of_ref": "indicator--cb39122a-b233-47da-b7ce-33e1ee8f5556", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86d89906-ad73-44c7-90de-158a74cb61f6", "sighting_of_ref": "indicator--4ce03f86-abc5-45f5-8fa1-4a51e4c72e7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--456f9bce-ea31-4617-92b5-df2150bb0df8", "sighting_of_ref": "indicator--b899f1e5-9c01-4bad-9389-244f3656b74d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c65e3aed-03c4-4a0f-a5f3-fdfcb3b4971f", "sighting_of_ref": "indicator--5e037289-f1eb-4ae6-a4f2-5175274f2b77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ec758b1-fb5d-4b53-aa6c-2dbe91888d0d", "sighting_of_ref": "indicator--01cdf582-d417-4eb8-b1c9-0ee005415f10", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93280cb6-c246-467b-b4f4-712e4ee34421", "sighting_of_ref": "indicator--ef8fa32e-7a1a-46c0-a0c5-8fd452276089", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87883f37-6f59-40d2-94f1-f95e950948ef", "sighting_of_ref": "indicator--7032018b-81da-43a6-b51a-ac9244f890d4", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af2f416-c452-4568-bf99-b147be791deb", "sighting_of_ref": "indicator--4870df7f-df89-4876-97c0-f6c4f2951eed", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b580784-a825-49a0-9cb0-23478e9961df", "sighting_of_ref": "indicator--29846599-2a13-4ae6-a22e-76c9a4a345f9", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6db086-528c-4ca0-98d7-0dc83df1d497", "sighting_of_ref": "indicator--b87019cc-67ce-436b-b1ea-8b2be7b326f7", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aafacaf6-7147-458e-978c-07cd7f67497d", "sighting_of_ref": "indicator--aab00e98-5b02-4c46-b7e3-0a7b37932f90", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8766fc9d-f012-4a29-9859-7c45b79ee9aa", "sighting_of_ref": "indicator--d76b25cd-8750-4f4c-a424-84616295c95b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a41c75-4de9-420a-9d78-a84257e5cbc2", "sighting_of_ref": "indicator--d94a71c4-4349-4b2a-a0d0-946bc2bcda2c", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50500b7-3214-4684-9ce5-197820f5a0b6", "sighting_of_ref": "indicator--54669bc6-acb3-486b-a637-5159f946889d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a654ef-88f2-4ee0-83b0-60b554fed69d", "sighting_of_ref": "indicator--2e6a16e7-c653-4c7d-a8b6-a849438079a6", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d54b0d9-48e1-456e-9211-ffa9092a42c5", "sighting_of_ref": "indicator--d4816875-f8d9-4c57-b8a4-18a746e34c44", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e18be21f-fae8-4d40-b2bd-831321ba5e39", "sighting_of_ref": "indicator--8e935e0e-b049-4a86-8c51-d66c96fc0e1a", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b305ae6c-d934-4754-a7ef-ae240d8b4bc4", "sighting_of_ref": "indicator--537ca114-00d6-46ba-84df-499375b4f1f1", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40e52324-2770-49c0-9e0b-d9bf8014df15", "sighting_of_ref": "indicator--e749ce42-0b2a-468b-b78a-117454142bf9", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2475849a-4d02-41f8-b6c7-0f533598e8fc", "sighting_of_ref": "indicator--7e818ecd-6769-4605-ad57-90cbc4ed055a", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d094b883-eede-49ab-85d3-6937effd5a92", "sighting_of_ref": "indicator--ca36f6b0-fc32-4363-a3bc-a8ae68fb5ad2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ad9102-59ee-48cf-85a9-3e883ba2cfcb", "sighting_of_ref": "indicator--ca36f6b0-fc32-4363-a3bc-a8ae68fb5ad2", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e413659c-73fa-4e2f-87ad-01f362f2e5ab", "sighting_of_ref": "indicator--66504773-c65c-4d78-b0a9-dcb00df63e08", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddf13276-57cd-488b-b6d0-7eed9ab20735", "sighting_of_ref": "indicator--f3095c86-67f3-4540-a3ba-9e2b67a8bdcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b9f8f6-97fc-4bd2-932e-c0852f3ce7c0", "sighting_of_ref": "indicator--15701a80-627c-4bdb-8ace-f55cf0408117", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68b034eb-143c-43f4-bc26-c2e05562f763", "sighting_of_ref": "indicator--ff3b4df2-3bb2-426e-a402-ce38d13409b3", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581d9908-f012-4218-a807-0c4a99b3808f", "sighting_of_ref": "indicator--47394f86-644a-4e0d-afed-60a13556e2b4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61097e81-2d60-4940-8ca3-b654c2ef244a", "sighting_of_ref": "indicator--47394f86-644a-4e0d-afed-60a13556e2b4", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--988e4b06-ca03-481b-bc72-f99f25f4a861", "sighting_of_ref": "indicator--87ba77e7-edf6-45a1-99bf-2f0bbdac2fa7", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--558457c9-9020-40ca-a9b5-834b9eb10c41", "sighting_of_ref": "indicator--87ba77e7-edf6-45a1-99bf-2f0bbdac2fa7", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dbd678e-21ca-4dcd-9097-54385dafa3f9", "sighting_of_ref": "indicator--87ba77e7-edf6-45a1-99bf-2f0bbdac2fa7", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf912fc-a1e9-4458-859e-2b8fc42f4db7", "sighting_of_ref": "indicator--8b77afd4-486e-4ab6-96e2-2c23068fac29", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb99f4b-e424-43fc-9600-d35e75271578", "sighting_of_ref": "indicator--ff40c11d-505a-4685-9884-7d682f79171d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c08db9-85dc-470e-be6b-65051d20cee3", "sighting_of_ref": "indicator--83c81187-6266-4b8d-969c-7947382bee22", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69f7a351-2db0-45d1-9770-c2f6fdbeada3", "sighting_of_ref": "indicator--40eb05b4-06df-4a04-9035-5a84dd4be128", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a92bb4f-dec1-4aab-85bb-8ac61a49f083", "sighting_of_ref": "indicator--c6e48b84-cccd-4e0f-9d02-df9329ec962a", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a393bd07-f025-40d0-a14d-441b775e87dd", "sighting_of_ref": "indicator--6f71f491-76b4-4a46-86a4-32888708171f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90dcf280-28ca-4b55-83d0-727ece0d51b9", "sighting_of_ref": "indicator--1839671c-dc8e-4cc0-9c4b-72d96e30d44a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5eed49-be86-4fbc-a67d-c0127bc05293", "sighting_of_ref": "indicator--c8789e48-4ef3-4c68-b462-663d0e0d6778", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d466ff23-b3fe-4538-9694-2a0b768eeca6", "sighting_of_ref": "indicator--5ec86b7a-f835-4eff-a174-67a0cca85fd4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6879a87-02fa-4ac3-8fe7-c1e8ed9bc8ff", "sighting_of_ref": "indicator--b66489ce-d502-42d2-9a88-77d14665279f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c758952e-e7f7-4e0f-b3b9-bfc6af0da4ef", "sighting_of_ref": "indicator--dad8ee49-bbd6-4b41-8f87-b9787f62109d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a395543-2ca4-40e2-8271-5db1350655a3", "sighting_of_ref": "indicator--84c9f04f-a082-4f88-8047-4796abc48857", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48aa809c-d1d5-4697-8723-94dad67689f9", "sighting_of_ref": "indicator--6e5dcf05-882f-4e76-ae9c-d20e35e9abc9", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f583976-6eae-416d-8304-fbcd1e65d78a", "sighting_of_ref": "indicator--31a4dd72-ce9b-4e0f-8e30-6119b2c49f63", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f49af3f9-9d53-4aa0-97b5-ee883a281748", "sighting_of_ref": "indicator--da5213c5-9a62-4051-b6e2-7f18e5ba5b4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e067fbbc-eab1-47a6-baba-9ceac97c1633", "sighting_of_ref": "indicator--58478969-d200-4235-aa26-b029698e5cdb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--730a64b6-a312-4303-88ce-1beb876be90e", "sighting_of_ref": "indicator--6f334cfa-65ae-4567-aabe-dc139fc03317", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8a8d9d-fb4d-4da6-8748-20f4ad852922", "sighting_of_ref": "indicator--79f4f338-bf90-496e-bdd3-902686812d0b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d56dc0e5-ddd4-4247-bebb-a616315fa33c", "sighting_of_ref": "indicator--79f4f338-bf90-496e-bdd3-902686812d0b", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105b2219-c974-4f07-afc8-571bc868a312", "sighting_of_ref": "indicator--79f4f338-bf90-496e-bdd3-902686812d0b", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6859612-f4b5-407e-b740-e9eb40179f36", "sighting_of_ref": "indicator--98c9f08d-1c85-436b-a1ca-7d90417d815d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ab10d7-cf38-46b7-883e-ae51e5083f83", "sighting_of_ref": "indicator--1cc30962-14d6-4df2-adf2-0cefef107df9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb6fcf0-41a1-4852-b8de-9859ebd683f3", "sighting_of_ref": "indicator--6b60505a-6830-489f-9d8e-b869d744b94f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1db93086-960e-439c-972d-33b9e73d86b9", "sighting_of_ref": "indicator--089323ab-8f78-40a6-b8d2-5c1ea6082088", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ab8afb-ba80-493b-a6b7-9fc1035828f2", "sighting_of_ref": "indicator--affe2c03-608f-4652-b475-930ee35fd734", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84f45ad3-fc09-4094-a0bd-942875519f2e", "sighting_of_ref": "indicator--201f041b-c9fc-4c0a-9e05-fba3e7d7fe83", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74641d28-b330-4c9e-81b5-48f907023999", "sighting_of_ref": "indicator--201f041b-c9fc-4c0a-9e05-fba3e7d7fe83", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5228f223-675b-4c42-9577-570a29c719f5", "sighting_of_ref": "indicator--201f041b-c9fc-4c0a-9e05-fba3e7d7fe83", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--158f0e97-6a64-43e5-a706-15efa455d1ff", "sighting_of_ref": "indicator--c4a3deff-8d61-4d6f-950c-c74280f9354b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fd8603c-de02-4157-b2d7-68c74a845c52", "sighting_of_ref": "indicator--c4a3deff-8d61-4d6f-950c-c74280f9354b", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--976e316a-1c3a-436e-ae82-0760710a23de", "sighting_of_ref": "indicator--c4a3deff-8d61-4d6f-950c-c74280f9354b", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df690c01-38c7-45ef-ae79-69221b747a23", "sighting_of_ref": "indicator--90f786a2-2532-4737-99ad-af9d7eec5ea9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b39ff8-0dc6-4507-be3f-0a90239f1964", "sighting_of_ref": "indicator--90f786a2-2532-4737-99ad-af9d7eec5ea9", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44873de7-5854-45a1-9552-4ef46d568881", "sighting_of_ref": "indicator--90f786a2-2532-4737-99ad-af9d7eec5ea9", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f445fb-12c7-4761-922a-6692a3d6d1c4", "sighting_of_ref": "indicator--b67dbc15-44cb-435e-9512-c4a6ff790ebb", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d04d7da-034e-4589-ae74-c88320c2df79", "sighting_of_ref": "indicator--a97ea7e0-ae21-4cbb-96bf-787a2f3766fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4de83b-fc07-4a9e-8e7a-aafe517025a6", "sighting_of_ref": "indicator--0a570bd0-ca0e-4b82-909c-53141f51664a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81984387-2a30-41a4-99cb-2fe06392774f", "sighting_of_ref": "indicator--b7d39e25-f48d-4e45-8360-caf6049f17ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e78bb9f-0d94-4355-bab0-a96265dfef26", "sighting_of_ref": "indicator--7856c57c-b1f0-485e-918c-496195f780f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03615b1a-ca07-4bdc-8357-813b03e020ad", "sighting_of_ref": "indicator--871cec43-a0c4-4e5d-8edc-665b3ed16e47", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4c9446-a699-42d1-9582-d3b96e0d119a", "sighting_of_ref": "indicator--53e9c1ff-0cc6-4f31-8752-dfc8d60a9fa0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6031583-00ae-40d3-8375-5a40a8d19c1e", "sighting_of_ref": "indicator--980504a4-f151-4166-a6ce-fd1b5f4e34cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f370915b-96ad-4878-9fc7-baa1ca604aae", "sighting_of_ref": "indicator--9f02eaf0-83da-4b88-9c34-c074c5a2ee6f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59267838-6f66-472a-9244-c9a60300d71f", "sighting_of_ref": "indicator--c630fcbc-fb20-4705-9214-a2b8014c679c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28129a3a-7659-4290-8fa8-fbe130a8d5b2", "sighting_of_ref": "indicator--f2fc31e5-2a8c-4c59-b43f-95e13def9c79", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ad5be5-a647-4a64-bcd6-3ba506f36fc9", "sighting_of_ref": "indicator--554d6629-36d5-42d9-a24a-28b4e646423d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95dd1717-b346-4aac-a4c2-d5d2c2ac196e", "sighting_of_ref": "indicator--4921a2d3-709f-4767-b373-5536e71ee03d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6920b5-d1af-4ee5-a93b-5b6c51d7eca2", "sighting_of_ref": "indicator--f0b100d7-eefb-484d-8c4d-570019e86c6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63150e4e-2620-4dcc-b16a-811bd2a7e833", "sighting_of_ref": "indicator--739a0c9e-4fb9-40b1-ae66-1694609e4fe1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ded0f0-7e41-4bd7-8cd6-71b4e1c255ce", "sighting_of_ref": "indicator--c815de4c-fb41-4f87-8c6b-372b7749a3dd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34125527-1c29-4b54-9c20-023b085262cc", "sighting_of_ref": "indicator--21ecb4a3-3d68-48bd-813e-c08dd503e85d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edc2120e-1242-40b6-9f2d-050ec8ccf5d4", "sighting_of_ref": "indicator--9569142e-b9c2-4ec9-8644-65dc9b983ecc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--279e8887-2a26-49a8-b4fc-b70c021f9736", "sighting_of_ref": "indicator--b102672e-7b49-4267-a806-3360ab5797e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2273c1ca-13d2-48fc-bead-8527417e833e", "sighting_of_ref": "indicator--b1669316-f0ad-416a-a122-149a9c49eee9", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd0476ca-76d4-4aaa-b140-5e6b25952743", "sighting_of_ref": "indicator--a8106ec4-e564-46c9-8590-3a770157d479", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9a876c-0f33-4f49-aa50-d390fa6b3e2a", "sighting_of_ref": "indicator--726869c0-c158-43cb-a2e3-a869945850fe", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a27a89c4-b650-4a57-8724-dfa880f8a886", "sighting_of_ref": "indicator--2fa861c0-58ed-44a9-8886-5c098d0964c9", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a3e67c6-bad4-4f34-81eb-5130b7ef4bf0", "sighting_of_ref": "indicator--c09488cd-2d33-44b3-a84d-2d8b6f6a5295", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f16aad00-a32d-4f0f-bd35-27895c0dc595", "sighting_of_ref": "indicator--33b9e267-dc7d-4220-9111-c4b5f5cecb1c", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--056fdfed-b1b1-48ee-bba2-9205ffdc5cc7", "sighting_of_ref": "indicator--26077318-1cd7-494a-90db-49033073e81a", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07baccc8-2a52-4645-848e-d0b02b86b053", "sighting_of_ref": "indicator--15655759-f3ba-46a4-ace5-f2cda289ee04", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8068775-6743-40ed-bbf2-b0e50873857a", "sighting_of_ref": "indicator--63a851f0-a0dd-41b6-8222-fa1c4245ff97", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c018e66f-4467-4b73-b1fb-3c0105cd18ac", "sighting_of_ref": "indicator--63a851f0-a0dd-41b6-8222-fa1c4245ff97", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da251775-72ec-4350-9c2a-bafae786ecc7", "sighting_of_ref": "indicator--12803bfd-b9a0-4150-be78-6f2d09826f12", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d2db012-bbe5-4ffe-aef8-2d1b21031f3f", "sighting_of_ref": "indicator--ae499131-906c-400e-a7a8-3062ad8f63e9", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--160722fa-5a84-4e00-9da3-7071f7d1b76b", "sighting_of_ref": "indicator--eef477f2-18f2-4393-8738-6b3e74d9a71f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c859b74e-e625-4b71-9499-1ebea1eca680", "sighting_of_ref": "indicator--686cb09a-d42c-40c4-8730-406e0b3de65d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc0bfdb-acc0-49c9-98ba-6eebd8376422", "sighting_of_ref": "indicator--6360a326-81ab-4c2f-bc26-7d623e5f4573", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a8af9b5-6ace-4402-b336-bd13a3b3815d", "sighting_of_ref": "indicator--b9e7fa80-8f5b-4393-8665-f710673c1158", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--839c3d09-040c-4fd2-ae6e-578f0b43b517", "sighting_of_ref": "indicator--d3db204b-58bc-4e23-8467-d6481c8f2ad5", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77b686b0-0881-4e16-bdf6-0a88eb6700e4", "sighting_of_ref": "indicator--73e70771-301e-4d19-80a5-04c821080a27", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85ee2f2a-ec67-4191-a4b8-a02252dd7e9d", "sighting_of_ref": "indicator--f5e17f86-fd0e-4d5d-93cb-db048b2e77a7", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e60c56a-cf5f-49bc-a8e6-368eea83545f", "sighting_of_ref": "indicator--bca3a33b-584b-4319-970b-5614505abdf6", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded699f0-fb63-4562-bbad-9664ba6a913c", "sighting_of_ref": "indicator--f729cf5a-56fb-4030-9fde-ec2b945360fb", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1850a687-cb69-43a5-bda6-376ca85d10b6", "sighting_of_ref": "indicator--0b029f6d-c7a6-4634-98e2-2a9f8d491c83", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c731209-2f8d-41a4-9d6c-d8e44c847d5f", "sighting_of_ref": "indicator--7b079eb9-2d93-482f-8199-0c4ec02eed78", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84bbff3f-878d-4809-8151-44c649592b6c", "sighting_of_ref": "indicator--ebba1e51-d163-4e36-9855-b6cb9bdf6a09", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c59350f3-a111-4a0a-9753-4b69bad08b1f", "sighting_of_ref": "indicator--8ca998ce-c18e-4a2f-9461-1cde16b0a41b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6b89ea6-ea27-48e1-9551-6a8019d6ed93", "sighting_of_ref": "indicator--8ca998ce-c18e-4a2f-9461-1cde16b0a41b", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be3e18a5-09bc-4fc6-8edc-c2ec4397f341", "sighting_of_ref": "indicator--b487913e-94c2-47e9-a589-2f2757e9eea4", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45cd06ce-3101-42e4-bc3d-c611e6d2469a", "sighting_of_ref": "indicator--26c8989a-3171-42ee-9766-53fb732e93f8", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e793f758-0997-440f-ba7a-1c64db54e336", "sighting_of_ref": "indicator--67601c15-f155-4ca8-bfd2-f667a5edff21", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a890aed-9cfc-4701-b4c7-5c57fd079edb", "sighting_of_ref": "indicator--778dda81-88cb-4b8b-9672-92d6febc51b2", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa25adc7-af6d-4d80-b4e2-eca1d5fb88e5", "sighting_of_ref": "indicator--1d756bba-2d8b-459a-a193-93659cdabb33", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd946237-58f0-46fe-97c6-245885930128", "sighting_of_ref": "indicator--7e1c3d68-4422-4097-b06f-70afbfaa879b", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8312adf-2abc-45ca-bf48-3ba942f49a2c", "sighting_of_ref": "indicator--7ae57f42-609c-4438-af2a-4b7c47c32154", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9bcf1e3-7ca7-4ab5-b403-ba61583024c1", "sighting_of_ref": "indicator--f2e270b2-a84a-4064-a93c-9f47f622197f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f8249cf-27a0-4a1b-9e56-f87be91ad6e3", "sighting_of_ref": "indicator--9081871a-41cc-4390-8952-2c1bbf5c7323", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b446babd-fea3-440b-9ac7-78d2b404a430", "sighting_of_ref": "indicator--ac16da56-db49-4ad2-b588-e7a70195475c", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9cb63f7-daed-4029-b327-7b12b91a532a", "sighting_of_ref": "indicator--8ed02201-dad6-47e4-a153-f81932674d7c", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--669e12bb-cab4-4c4d-a74e-3790b86dc648", "sighting_of_ref": "indicator--a7f8a2e7-d4f8-44da-8448-902139fec3d6", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b347d6-ee02-47e1-9f4e-f80e8b687c92", "sighting_of_ref": "indicator--a430050b-288d-4d62-bdf4-e2d3ebc159f4", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27d8e207-9bb9-41ee-9228-c6ed632b3019", "sighting_of_ref": "indicator--4f6f8078-ca0c-490d-928f-89a41f28f2e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d9ad51d-cb8f-4861-be7b-edc13b9f7a12", "sighting_of_ref": "indicator--63a4688f-3360-4595-a73d-5a48aa3b6bbc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3593a77-8edb-46bc-b4ec-88f3c2b1b6d7", "sighting_of_ref": "indicator--652651bd-83ee-4ba2-a5bd-6880a92de220", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c95bfa3a-1e5d-4a7e-b248-5c6efca6aec0", "sighting_of_ref": "indicator--ff328077-03e3-4294-89a6-b41d9db600ce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2bf749f-ad87-4f4e-bda2-cab5e386f261", "sighting_of_ref": "indicator--790e77ea-fa3b-4b37-8a40-6f25887b54b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c675e39-d58c-4b04-ae61-6cc712b85533", "sighting_of_ref": "indicator--b28d57af-bac7-4a4f-8ccd-3b3bba1aad57", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d691258-9933-414e-8f80-d914369c008f", "sighting_of_ref": "indicator--9940241b-e3e5-4824-b6a5-c5890295626a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--043c74bf-f327-4f84-9f9e-0c79738dcbef", "sighting_of_ref": "indicator--bab63175-5ddd-454e-b45b-a7c3836b86b2", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcbeee74-2ba9-4108-b341-450a43d5fd3f", "sighting_of_ref": "indicator--b1ff378e-dfb2-4474-b20c-9a0d414ebe27", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7debaa41-4485-4730-83a8-9b715a30c1b2", "sighting_of_ref": "indicator--dd9353fe-2512-49cb-9921-047aa5c34a81", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--885af5e5-7c38-4d9b-b3b9-4e1c9856040d", "sighting_of_ref": "indicator--4e40ec8d-6ae9-481a-b70f-fbdc03ef773d", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa829479-d432-4c4c-9cc9-bfadff25ab39", "sighting_of_ref": "indicator--9f3f4e49-2dfa-4e3e-a3e2-4884b7b007ae", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fec8be-c1e0-415a-be74-6401f5c0fc82", "sighting_of_ref": "indicator--9f3f4e49-2dfa-4e3e-a3e2-4884b7b007ae", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd911013-57ed-493a-add1-7e35e9ec48e9", "sighting_of_ref": "indicator--9f3f4e49-2dfa-4e3e-a3e2-4884b7b007ae", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3e3faa7-2d29-4cfb-b098-ba5f934bad63", "sighting_of_ref": "indicator--bc2a0586-40ab-4cbd-8a09-176200a39083", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa9a8159-6420-4407-9406-8284fb0a48be", "sighting_of_ref": "indicator--003813ce-7944-49c2-80bb-0674b688339f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b0eae04-a4bc-4ff2-b355-154c4adbde6d", "sighting_of_ref": "indicator--c945287c-fde5-4dea-86d2-c1e453bf1bde", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2868e1b3-463e-4d73-a3b3-bbeb2b8e7e36", "sighting_of_ref": "indicator--acfbdc2b-c0f6-4009-83d4-59d756406596", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e981e190-022b-4a67-ac21-045b1a1b9451", "sighting_of_ref": "indicator--fb60a0f8-b67c-4738-a02f-1a0932485535", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f83052ba-b4ee-456b-82e1-78459497bbfc", "sighting_of_ref": "indicator--15c8cc24-bc85-49a6-9450-a1cb7a718a6b", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4149d329-a709-48be-a0b1-71825d79a575", "sighting_of_ref": "indicator--e96966ca-0666-41e8-914f-589b37300bd1", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f217de3-e817-45e9-b7de-98e84ed0f358", "sighting_of_ref": "indicator--001f0b3f-e30d-4ecf-80ad-d70e28dfa875", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7241c03c-765f-4e94-9636-e9724fc3f4ad", "sighting_of_ref": "indicator--76515519-6da4-4ad2-a8e2-8aac830d7bf3", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aa26ead-be7a-4c25-8b17-8c6e6106d2b0", "sighting_of_ref": "indicator--1b7df1ab-39b6-47db-94ef-9556c2efebb7", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad44e586-a823-4c98-a5b7-d609de3cf654", "sighting_of_ref": "indicator--f36219e9-6d31-4781-ab7b-9f4cec4ca0f0", "where_sighted_refs": ["location--69ee89b6-ece1-40fe-bb51-734260f1740f"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9103e310-14e7-4cac-8798-ea8bf39f9a6f", "sighting_of_ref": "indicator--72010ce8-3735-4531-88a9-dec3c2f3d5c9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c89f05-56ba-4fc2-8555-63bb5a099dbb", "sighting_of_ref": "indicator--4c8a49cb-3d66-419a-8aab-80ba2014a386", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6edb319f-7c4b-4151-ba5f-9f0e78e54972", "sighting_of_ref": "indicator--05f00bef-aa72-4b7c-8e24-d3ac6e446df7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1edafc5-c9fb-493e-ac13-6226d5214d50", "sighting_of_ref": "indicator--4a2aaac1-516f-4ebf-8899-a7453c18e205", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4059cdde-f30d-4810-a5ea-cd682ce542db", "sighting_of_ref": "indicator--d4834a09-e1b8-4f52-ae30-c5876f0d63a7", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f864f76-35f0-4435-9761-4043e9c14f87", "sighting_of_ref": "indicator--996ff60f-2061-47bf-ae8f-92762d469ee9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00eb3d07-1a66-47d5-95d2-23cc76b08e8a", "sighting_of_ref": "indicator--7cd399b7-6c88-4d22-8950-a1d3c56b84d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--527305df-f55f-4442-9bdf-18ed4564a9a6", "sighting_of_ref": "indicator--b2a21223-0e13-4b0c-a6b6-70ac3f810c58", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b145af-17c7-4200-b137-ba144d0e9d61", "sighting_of_ref": "indicator--9d9bca2a-2a5b-40f9-9d37-40d7bc0e22b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b67f83-87b8-48f0-bdc3-320f2a705436", "sighting_of_ref": "indicator--dfa9801a-cbe8-4d8c-aac1-78b016d2ad23", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67545975-0eb9-4600-a722-a38233a2ead4", "sighting_of_ref": "indicator--720ff5e7-a2f9-481d-9ddd-3a9608a57b28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbe37adc-4281-4e06-8dd4-b6208e6ce548", "sighting_of_ref": "indicator--cd7a21c8-775f-42ac-8265-c931bc0d9674", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ed5623e-b2c3-4ca7-93a4-cdcf4a659b58", "sighting_of_ref": "indicator--e235bf7e-a0d2-4090-b26b-bdb1b6262484", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e2093e4-92f7-499c-9ee0-2be5fcb0be7d", "sighting_of_ref": "indicator--1818ac56-0582-4b3d-84b7-02bffadb7952", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abb1ea1b-ca9f-4308-b457-9b3396fcc583", "sighting_of_ref": "indicator--067f08ef-3ec2-4235-9c9e-4809cbc6df01", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f799734-d52a-48fe-a24b-0e5a8ef1cac0", "sighting_of_ref": "indicator--e84cae8b-9e33-4c31-b56d-dd1b76f4781d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5563dc24-ea6c-49a9-bd1b-6148aa348d98", "sighting_of_ref": "indicator--e42373dc-c017-4883-8a7b-685342e7d77b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ed25448-e631-4cba-9210-aead2f067a21", "sighting_of_ref": "indicator--1fb2c868-74ef-42a6-a6f0-4b6184c61839", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f648cd9-840a-4f62-89c8-280351f94dba", "sighting_of_ref": "indicator--56a6f80a-4515-4d00-b012-4eab5058a8fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35262ef6-8eed-4198-9fc4-92a90e91ddb8", "sighting_of_ref": "indicator--840528f8-a4dc-4b50-8dfc-9185ab1bca2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ce8fbc-2f70-48d1-b0fe-8c8fdf1b46ce", "sighting_of_ref": "indicator--bce0f43b-d0d5-4127-a22c-0bd789e7a1ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8da627a-5a50-4103-bbb7-116f97916da0", "sighting_of_ref": "indicator--a56bee91-a706-400a-b834-d8f238565adf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54777432-6faf-425b-9090-36eec49f0896", "sighting_of_ref": "indicator--476600e9-582d-4883-9d5f-e579e61e6ab2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7c00f2d-b2e1-41a7-ac62-9571a6b2cbd6", "sighting_of_ref": "indicator--993de8a9-a7e3-4299-ba1a-000360cf3911", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05ffd9a-59f3-4a36-ac0e-0c0cadb92887", "sighting_of_ref": "indicator--5093e6ab-254d-409c-afef-2c9c9a84e59f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b78282b-78fe-44f2-aa74-e2215dd3759f", "sighting_of_ref": "indicator--40cc0404-c448-4986-a1b0-c2fc0e8eb96a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a7f41ac-185a-478b-ae01-8ec7c9f952c0", "sighting_of_ref": "indicator--2f3f7983-6fac-4a96-95aa-eacd2dea45a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9284b1d2-548c-4634-afd4-29a36d4d467b", "sighting_of_ref": "indicator--f5dfea57-3ff0-4454-bf40-938d8b2ab20e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96bb28d7-ba8c-45db-860a-9e67932b6584", "sighting_of_ref": "indicator--02902cff-7eba-497d-a1a1-e81ce860695a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555d38ea-2614-44c2-ba95-38fe1aad2312", "sighting_of_ref": "indicator--eabcd843-cb21-408b-beb9-a7f7c4943131", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76174382-9a92-4f05-9f77-db349f9b4b1e", "sighting_of_ref": "indicator--cc7cc57c-d73a-4f00-b5f0-fbddea9a5d4b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cda2060d-6289-4009-bf8c-db06023ba77b", "sighting_of_ref": "indicator--3b631351-9a70-4f6a-b02f-6a479e3cb97f", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e4b787b-f5b4-49f3-b35a-5fbc94223671", "sighting_of_ref": "indicator--e250b048-2b02-4bfa-a98f-d2e5b52b9c17", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--652d7a69-c0a8-4b34-be0b-f39a17c0f6a7", "sighting_of_ref": "indicator--34c73e78-9756-4384-be29-9e0ec5c39fdb", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a3784c-07b5-4c4e-99ca-88a4997813ef", "sighting_of_ref": "indicator--531fbbaf-f4ec-41b8-a551-46632fe719da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbba0fb1-fd78-4a2a-ada7-98be0a3bed21", "sighting_of_ref": "indicator--7b3c5ccc-be74-4a7d-aff3-05156c620aca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebcb0c0d-c305-49d4-a824-c3685a693bd2", "sighting_of_ref": "indicator--353ac4cb-a7e9-4e3d-abb8-f3eb42cda874", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fad61be7-90bd-4b36-bfb4-b1f06789d9ed", "sighting_of_ref": "indicator--97df7f2e-6e31-422c-807e-0833bb1d2c76", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a5e079-6ed2-4eb4-9654-14bdb2663789", "sighting_of_ref": "indicator--3799bd84-728e-4a1b-b239-4f7329955db1", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e55e9239-1c4c-4b8c-b414-e7f96187c9e3", "sighting_of_ref": "indicator--5134399d-56a1-4f52-af18-1dc3d59604f1", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--933f3156-8b50-4908-8b37-6602e250fb4d", "sighting_of_ref": "indicator--f8b3420a-8d86-43e4-8981-c6e5936b5311", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ff3a58-9a9e-4fe3-a1e7-32fd17371411", "sighting_of_ref": "indicator--a62ad187-9f3b-4fa8-ba1d-760dc83e2065", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ea974cc-c73b-408b-8458-ad1debe3cf67", "sighting_of_ref": "indicator--0a511e28-27b5-4fe5-a761-73a6aea6169d", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ac5cbf7-b8f1-41fd-b728-f208b6e8c230", "sighting_of_ref": "indicator--79f53216-2a83-4df9-8999-ae2d0efe48b4", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f58cc416-9162-47f6-a0dd-469aa7f64456", "sighting_of_ref": "indicator--f76bf7d4-a3da-49a7-b37e-638b31e35472", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c5a7231-c7ba-4e10-87f0-12279aa5049b", "sighting_of_ref": "indicator--2658df3f-4803-43ab-bd4d-fa0d21521d91", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--466ed80d-80b9-4209-a9e5-c1c719069e8e", "sighting_of_ref": "indicator--0bc896f6-58d3-467c-bc0d-a0dfdcba123f", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--998d59a9-0a3a-438e-9cb7-ea0a83c0a1b4", "sighting_of_ref": "indicator--f98fa4a7-82c6-46ea-9953-719e6e414dbe", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb864e0-79a7-4334-800c-e7d6badfd64b", "sighting_of_ref": "indicator--4b4e709c-1aa1-4396-aed2-be17ac9aa24a", "where_sighted_refs": ["location--5f547bbd-bad6-4030-b7c9-99a6144fdd47"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d4d053-eff9-4e33-8d05-0855b77ede33", "sighting_of_ref": "indicator--6e755494-a9ff-4af4-b76f-33fa80328fd9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2c01e0-602d-421d-8cf0-b8b2a85babdc", "sighting_of_ref": "indicator--eb04465f-65ef-41be-ab20-61da9fe0fd61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f224a031-077a-4772-94a2-5be22fc77ec2", "sighting_of_ref": "indicator--db7766a0-1b3a-4939-891a-c1b7560e1792", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b108908a-e0b7-41c5-b1e2-8e25a4467208", "sighting_of_ref": "indicator--9de4cf43-483a-4152-bcf9-1ff855c684f5", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdcf0c8-8301-4d79-84fd-30ae7a3bdd1d", "sighting_of_ref": "indicator--093f1235-8b3a-4662-9450-17900cd4934c", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6df2d62c-84da-4cf2-87a3-fb4afcc08b6b", "sighting_of_ref": "indicator--cd10ce16-df2d-43d1-a67d-2e55214f8a17", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d466fcdc-52ac-4179-b66f-a7c7a8be9556", "sighting_of_ref": "indicator--1727abf7-c93d-4f57-90f6-a52570f242c9", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c0c773-d58b-4437-8d47-63b63a353d85", "sighting_of_ref": "indicator--313c00ab-0e73-48f5-b492-48af194cac9f", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f03a0323-e53e-4485-be6c-0ec1e9191d8c", "sighting_of_ref": "indicator--c92a130d-64bb-4d8b-8fcd-2cebcc28b732", "where_sighted_refs": ["location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d77fdc-c626-47a4-a7c7-22c466fed08f", "sighting_of_ref": "indicator--97c8e339-eb90-4892-910d-75cdc326a144", "where_sighted_refs": ["location--092a2882-318b-4d98-a83f-5c85ada64ab2"], "first_seen": "2026-08-14T00:00:00.000Z", "last_seen": "2026-08-14T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--582b97e2-1764-455d-a43f-46241211cd40", "name": "Threat Report for 2026-08-14", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-08-15T11:00:02.007Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--092a2882-318b-4d98-a83f-5c85ada64ab2", "location--69ee89b6-ece1-40fe-bb51-734260f1740f", "location--793da0e3-68b1-4a5c-aecf-8e2a3a5d4639", "location--5f547bbd-bad6-4030-b7c9-99a6144fdd47", "infrastructure--7cda1237-c58c-4edd-b015-436b85df8aa2", "infrastructure--428ea2db-62e7-496f-b742-68083abb966b", "relationship--e07b6b9e-dbac-44a1-9603-06671e58007b", "infrastructure--1310ab91-d364-454e-8f0e-7496bd821726", "infrastructure--43ed2604-f93b-4fa2-ae76-0f25998de74f", "relationship--ea2b3dcb-6be9-4b6e-85d0-1b5ec240f1c2", "infrastructure--70c82ce3-dc30-4a35-8785-e2ea67fed5a9", "relationship--7ba01a46-aa9f-47de-b104-e225d8f0da4e", "infrastructure--01321170-de15-46eb-86fa-805fa14f0f1d", "relationship--eba9cd58-e651-4d7b-b73f-97dda0b125bb", "vulnerability--d995337f-3a6a-48f7-acf8-858aaeea06f6", "vulnerability--23040cde-b2f0-413f-adac-56da3cb1b949", "vulnerability--d00d2319-21cd-4ca9-8c4d-b6297f2fb116", "vulnerability--32fb7dd4-7644-4b39-ae81-f6c9d3131c2a", "vulnerability--7705553e-f518-4886-8316-dbeeb232287d", "vulnerability--c685ada0-ee6a-495f-9f2e-2096472a3bff", "vulnerability--6fda95d0-3ea1-4143-8227-d6cc30570c4d", "vulnerability--e215895e-0380-4bcf-bdca-1794991ac27d", "vulnerability--493e25fc-5c3d-4474-b68f-89943481b076", "attack-pattern--602345fd-8404-4ced-9f61-e941a9175e32", "attack-pattern--18f6868e-2376-4cb6-ac58-4d2a65888852", "attack-pattern--a60bf813-6fb5-4be0-b1e1-88c91aa754cb", "attack-pattern--46959998-0702-4d9e-a7d3-3dab6dc672e8", "indicator--51a645da-d72f-4388-9126-ca7c0ec56237", "indicator--b6fe13c3-f8b7-4f98-ae6e-6c592e58076d", "indicator--85ba71fb-2a4c-47a5-aa4d-4792c301dbc8", "indicator--f7157617-7137-48ae-a906-fc828a1dd072", "indicator--a4f46a10-06be-432e-a486-526a189ecf0d", "indicator--16a90444-1867-405d-932a-e3e69477548b", "indicator--3a1a1e01-b2e4-45ad-88d6-ce5ed7b1d219", "indicator--2631beb8-1a95-417f-8836-e80798eea332", "indicator--ff18443a-125e-415d-8967-d9c75ef9abe6", "indicator--e57f3658-cd4a-450d-aa84-9f1b885512c7", "indicator--da37f661-bc31-43dc-a627-70130270c414", "indicator--3863cb7b-434a-4a42-876d-07f310738c87", "indicator--af223f3c-9fa0-4897-b40f-20479ad864f3", "indicator--9a07dbad-96eb-46d7-904f-b2228add5ebf", "indicator--5004ff9f-46b7-4c6d-87dd-dceb62957202", "indicator--822e830a-9008-434b-bd3c-e509180ac19f", "indicator--a11a022a-75a7-4bbc-809e-2d1148938ea8", "indicator--f4ea2e56-b9e4-4b54-8da2-78e852be10ac", "indicator--e216bf90-430a-45b6-9a3e-d0a236747095", "indicator--9109c39e-9099-4495-b049-fd9331eea615", "indicator--95cf18d1-1a5d-4605-81eb-206899be948d", "indicator--7d5840c7-c288-4f78-b2a7-b7b942e95ca4", "indicator--70c77c37-ab20-4f15-ae07-125cbfb9966e", "indicator--30cfa224-b942-427e-b135-b27dd096cbd2", "indicator--36a9f9b0-f8cc-4d0e-aae6-3437b9f1dfc4", "indicator--2a84a8d2-80e8-460e-bcb5-b9a978346373", "indicator--4a835d45-3768-4599-9508-b4b70b02b6d4", "indicator--8c443def-cbaf-438a-be27-ecdc99f4fe71", "indicator--3194a6da-3b58-4812-a8b1-14918bcf737d", "indicator--85c9674c-7565-4d69-82e0-59baeefe59c2", "indicator--f5b88698-3e74-4e47-9681-1c67137be68c", "indicator--1eec236b-8c75-4d1b-b5c1-a27df9437ffc", "indicator--03ac1fa2-fced-4aab-8ff8-43a4efe8f3c2", "indicator--783040ef-8c03-4922-95b7-9e0d3a1cb0a2", "indicator--3a08259b-002b-40f2-903c-2cb70567d5d7", "indicator--e3e1ae14-1632-4a1a-b04f-e6cd4454507c", "indicator--4c777cff-2f17-4d17-ba29-9de0d9d726b2", "indicator--12d3fb82-9e08-41bf-8b5c-f731106f818e", "indicator--840421d0-0e7f-49c1-944d-e1b7f97e0bcf", "indicator--9b6c5270-ae4b-4935-a1b7-c3f050c01d44", "indicator--9c05dd56-9f84-46a4-b5f2-3b8e778d36f9", "indicator--52b5d6bc-c234-41a3-a517-fe8e06ba2eb5", "indicator--8db05bb2-cc99-4f28-a25c-b0caa746f7a4", "indicator--4bf20a9c-0b57-4a93-95cf-c67e1349cc44", "indicator--95cec8b4-1a4b-42a1-924d-5933e9979fd6", "indicator--0e40d887-5dc6-47e1-b8bc-afd01b086511", "indicator--3b8e00bd-b049-443a-8faa-8e9ea419bd91", "indicator--6b1139a6-ff14-4dde-8504-6b68cec1640c", "indicator--b4c4f730-b58a-4c29-b55a-7ff18fd46c3d", "indicator--95fa9599-6cc1-44dd-8a46-c588d61bf6b2", "indicator--0205b77e-1490-43b3-81c6-89ed162a645d", "indicator--cfe478e6-0f26-48d6-b776-0f196923d733", "indicator--3cfac35d-04e5-4d80-99be-62d0e304aba4", "indicator--9bb9d56a-e8ca-48b6-9e29-c0907e7f541c", "indicator--b68a6eea-963f-47cd-bdd2-2cccbb40e342", "indicator--22cb9b41-3fd5-4006-91dd-dd0a004fb6a4", "indicator--bbc221ca-c377-4479-8e4c-1a7f81dafcbb", "indicator--b1bae2cd-a323-4eae-aa90-d0538ffc3fe9", "indicator--3ea69c05-8c41-4cd5-b9fd-02b8dac83ec2", "indicator--7904a2a8-227d-4bd6-9c8e-8ca1a4b9f154", "indicator--05032dc6-3ee4-4c74-b4f8-df7794428484", "indicator--76c5e174-c8ca-4f18-b632-f3bd3215430b", "indicator--83ba6a59-e50a-4d6c-9790-c5a1ab8dcfe5", "indicator--49873cb0-1c56-46f9-a37d-44f9eba6565c", "indicator--189c9916-96e5-4c10-aacf-e94d133562f9", "indicator--50690b1c-4b04-47a7-a820-22a371531efc", "indicator--9881531b-20aa-4bf9-b5d6-c8099c79b6d2", "indicator--8f1eedf9-3b6f-44ee-929b-8960cd99df80", "indicator--40401d2e-4e3f-48bc-b262-a9382e12dfcd", "indicator--1c0c3694-247d-4547-88dd-6235ea4a239f", "indicator--16481229-290d-4aba-9fd2-6b986eb5c37a", "indicator--63c9e58a-ba44-4535-8e88-ecd27cdfdc82", "indicator--d481c114-32bc-430a-9843-9336f5de1fed", "indicator--51121527-f359-4ed9-9ab4-c93f1872b64f", "indicator--c5094e74-36e4-4734-8e5a-a0261d0c1486", "indicator--af5b1ccb-a2ab-4c48-bb15-0fa2136aa04d", "indicator--592bb99d-fdf0-4f9e-8b6b-6e38080c288a", "indicator--017d27bd-d31a-443d-9a2b-4ea0c9a0411e", "indicator--10f15cc3-25b8-45bc-b779-a823525478d0", "indicator--d112eec7-a9b5-4fdc-ba2d-31f8ca9f291a", "indicator--064ee60a-03a7-4fe4-b797-d5899be203aa", "indicator--e18d90d7-1307-41a0-92d6-9ee6896b437e", "indicator--2255412e-cc15-45be-a9b9-671a4c9cdc54", "indicator--b2830eae-31d1-46d1-9e0a-5b4d65722f01", "indicator--427ee8ef-0f45-489a-b4f2-499c6cf07a11", "indicator--c1633aba-dbc9-48fb-b615-322e4eee36f1", "indicator--d1a59581-ff6c-488b-aa34-dfd4d660738e", "indicator--7f7480d2-082f-4227-8e06-070facbc2ee5", "indicator--18fc8679-ff95-4efd-aebe-fcc79233bbc9", "indicator--c748a2b2-3d51-40d5-b311-197fec4eba85", "indicator--3ee26913-8a96-46cf-96db-58c1ffbb911c", "indicator--0607b022-0afb-4b3e-8d38-d900cecf3d13", "indicator--4b937791-d48f-4d35-8a8f-82799c94eb9b", "indicator--bac0c25a-af2f-4624-ba37-15fb7da64a86", "indicator--6daa7c8b-722d-4f1b-9749-d1f8233a9d71", "indicator--b8361621-1b89-49cf-a114-ef26599d1ddd", "indicator--ef579ff5-b788-4114-80c9-350468587006", "indicator--9b65a0cb-95b4-4a78-904d-209aa3ac9ad3", "indicator--93545637-03f5-4d8e-9116-7058200a8768", "indicator--091d0c40-24b8-4f78-ab64-79109924ecb0", "indicator--90d74712-4570-463c-ac77-c3591526d7c4", "indicator--06d0793f-e598-4c2a-a06c-42e674ead770", "indicator--25d5fc31-f6ee-4218-9f97-4cd9a6732063", "indicator--a8bb9372-bcef-4bfc-b18b-eb18455b4440", "indicator--b9d3ebf3-d4f7-4359-a117-c9fe39a2d5bb", "indicator--16f7adf5-c8f7-4b1b-a406-9a20d80335f3", "indicator--4ecfdd57-c575-4708-ad8f-b83a690fd70b", "indicator--75810cbe-65e9-44fa-9e5a-115e13e73944", "indicator--ed26404d-fdf7-4ff1-98b5-0f5cd28f9514", "indicator--2a483aa2-5707-4057-971d-1f63598ba6e1", "indicator--808569ca-1774-484d-8a32-835fb1cf7e89", "indicator--ab6a0e2c-2df1-40ea-82a2-1b2d0e2f60e5", "indicator--854985bb-6428-4272-953b-b978b3988c1b", "indicator--b7699c8e-bf4f-4b81-be4e-b49ccdbd27aa", "indicator--004bbef6-d6c5-43fc-ae7c-0bf53b265841", "indicator--f355b202-eec5-450a-9b5e-ed84b5222255", "indicator--5df2a02c-074f-46c0-a7b6-6a8d7429f2a1", "indicator--f92f81ba-42bc-424d-9fed-e575f7ae102d", "indicator--37a9cbc2-1a98-4238-b2f5-fc306985bc5a", "indicator--a029c972-daaf-49ab-8b82-c9ec659cf1ca", "indicator--b295c789-e957-4939-b930-c4363eaa2c09", "indicator--16d99856-7233-4123-95cd-396f6fc93987", "indicator--d3909260-231e-46fe-878d-c4ac16f1b68f", "indicator--957c9ada-0512-420f-b353-920444506630", "indicator--6b35cad1-238e-42a7-82b7-d4fa86985bf3", "indicator--e90a303e-3187-4a29-bab5-3c6cce14bddd", "indicator--c84081be-8098-44cc-ba88-348307ed3b14", "indicator--d9d88e5d-b768-4773-970c-4948cf086693", "indicator--8441ce37-27b8-46d5-bc3b-c71e22ea8dd2", "indicator--cc96be05-33ab-4d71-aa9e-2990e360633d", "indicator--4ad6e7d5-7941-4020-8835-fecbc8f964db", "indicator--abcb63c9-83b1-4e94-bdbe-30c2ea23d642", "indicator--c28de4da-0638-4a66-92d0-83eb7e74d3f4", "indicator--56067b16-a001-470d-b54b-6daf51c8d243", "indicator--d2aef9b6-dac3-418e-9eec-38a57fd1508c", "indicator--e1657ce9-94f9-47bb-8e3a-f34aa1d04bc9", "indicator--54324154-91cf-42c4-be09-0fcb561c73c5", "indicator--eaba6b6b-aa0c-43ec-bf85-0a656a78dfab", "indicator--390e69eb-e1c3-43a4-9c29-aa02e6f4ef8c", "indicator--00bb57fc-1493-43c8-a1e0-971528d35a18", "indicator--6cffe00d-ff41-4c4d-a039-e47ea0d7403b", "indicator--2fbbc3a1-5546-4215-be2d-cf3d4e047f6e", "indicator--984f4832-88b9-4f3d-b3ba-9f021ddb3797", "indicator--a589a08f-9cb3-46e5-b7d3-809fbc4c3666", "indicator--ba5ef5bb-2679-44dc-8e11-e0f72098f000", "indicator--65923a65-5ebf-4da6-95e0-ebb365304ea3", "indicator--c4c6e22a-9dfc-4c47-967a-ced5c5b782f8", "relationship--297a2570-6283-4fbd-a108-a820cdba8002", "indicator--af5af0ab-8ed4-4d72-9673-13dc77a24408", "indicator--e3241520-4b0f-4735-989d-484a52f622d3", "indicator--b25bef2b-55a8-4ea3-9c02-4ebd28ca5687", "indicator--9bc9eb02-b6e5-49ef-a23e-0aee218313a6", "indicator--8ef2caf4-eb62-4dd9-b7fc-208a86f9dea1", "indicator--0c40870b-6395-42e5-9a70-f828443dbf35", "indicator--ff666a88-0e75-461e-90e1-cc37b6e622dc", "indicator--321778e0-4a37-4ce3-97cf-ce0b7c6ccdce", "indicator--d6a2714c-0746-4e59-94bb-9c4cc83e1cff", "indicator--bf5545b6-5c5e-4917-aa71-9bb061060082", "indicator--1f905f9e-23b8-4fff-baeb-e3723a4f2e77", "indicator--c32eedca-df78-4a36-b6ef-376142b6bec8", "indicator--afc37e95-14c7-4d8c-a55a-b78bc1177fb0", "indicator--a14a3f13-38eb-4c1e-b503-27ecc45907a8", "indicator--8bdf5d65-dd01-46a0-bb2a-85de2b252d0f", "indicator--ac828e66-9fc8-4345-be77-7921d8a8951a", "indicator--e81a5ec5-b17b-4470-8c2a-8353900b2c7f", "indicator--80c4b1cc-3870-4b91-bb61-15a93294fb93", "indicator--b1b4530a-eae9-4138-b680-4b3755dc7430", "indicator--abb54623-cc9a-40cf-b1c1-30de502670f5", "indicator--46ba8951-e9d9-4d38-95d5-bb654044e113", "indicator--e055f216-5463-4da9-8c52-bc669d273aae", "indicator--cd7c7838-736b-4189-9271-85282aae0463", "indicator--9ebdf27b-367a-4976-ba61-f4ccf270b95c", "indicator--8a006cad-a0ad-4684-a0a2-94fdaf26b512", "indicator--6cf10526-628a-4959-af5f-5e248c9651e0", "indicator--2a4a5258-2fbe-4da0-b868-893f24ba08fd", "indicator--c69d5d42-304b-4c00-9569-f5f5b51b828a", "indicator--d23f2952-9e68-4df2-901d-2ff3de625173", "indicator--aa083b09-32ba-4a03-8e40-19391afbafef", "indicator--17349ce2-ce07-4e88-b5ac-dd8126d74ab8", "indicator--392a63e9-c3be-4f04-a183-2fc2276fbc16", "indicator--9acc415e-341c-44e2-8188-32232993b770", "indicator--4ad7042a-bd33-4a8c-b553-e7390db5bbfe", "indicator--9d10bbf1-0ded-400f-85bf-3fff0b35f6f7", "indicator--0983e42b-410e-44e9-8922-00c063966707", "indicator--96e8296e-bf7d-4937-969d-c97123dc58f7", "indicator--7fcb1766-8ca0-4a8b-b9ef-c8a68aacccbb", "indicator--38cde433-981e-4a60-abc8-05a6d5a5bf48", "indicator--20b96bb6-0744-4b1a-8c3a-5bc9487c35ec", "indicator--2a3eecd5-e4a7-42da-836c-f8f78ba56452", "indicator--388b3a14-7b2f-4f68-ad9a-747f0bb00db7", "indicator--c14ca714-b62c-4df8-8147-8e439bb900d3", "indicator--e1829eae-be33-4e09-8d16-82dbb8907311", "indicator--bb6e6ca4-cf14-4071-8b60-546816514a77", "indicator--e933b770-bdf0-4664-8da4-2075ea21f78b", "indicator--a7cc9702-7e58-4118-b5f2-06c2cb1a45ac", "indicator--cb55f79f-028a-455e-8452-c9b68cbd42fb", "indicator--4a00d735-bca7-4800-9934-efd8167e987a", "indicator--b7cde0a9-6758-40b2-ac1a-b4dad7d3d7b4", "indicator--c01ffd54-5275-43ea-a288-cf9f58ca30da", "indicator--aee1b6d4-f6e1-4a8f-8def-03231f52bf9a", "indicator--5320219f-e620-488c-bac3-5f0b9c1168f2", "indicator--37cd7bc6-9e00-4d72-bdd7-48f5ed912fc0", "indicator--6f63a246-1fb3-458a-a824-3ad5d909012c", "indicator--4615e02c-ee94-45d1-8e0f-0e293a48acac", "indicator--e93c34a3-bfef-464b-a796-b80fedb51095", "indicator--26f13396-14ae-4c66-8467-142a76f0e9ad", "indicator--a9b9ee9d-ac1b-4c1c-ae83-8c710f7a55b7", "indicator--dbd1aa50-fae4-4cd9-9c08-db0817e56e83", "indicator--1e2cf80c-42d4-4adc-a056-de1ec204766a", "indicator--024fcf48-e7a9-4cda-a29f-74171fc5c25f", "indicator--44e0ed7b-6be3-41ce-91c9-dd0bd9be866d", "indicator--1dfde9e8-3f2c-4578-bd40-33764370115d", "indicator--b844dda3-1f62-40c8-8632-b7a99eaab91a", "indicator--c46c01d0-0a6d-4291-8b71-34f4f92149b5", "indicator--e5b944cc-cba8-4c49-93f4-6b6308b61b0d", "indicator--1e0524e8-f9e8-4465-aad7-53e901c1cd46", "indicator--8c014bcd-1c7f-4901-a84f-eb59c57b0a90", "indicator--b3b7f575-25a1-4e90-80c3-34ecfbd0e9cc", "indicator--9fdbfea7-303f-4720-bcb5-ec135a4321d9", "indicator--5d6df261-6f88-422c-a80f-6a02eebb0931", "indicator--ecf23346-bca5-4364-b1a6-2d47df56ee0c", "indicator--535e61ca-c2ae-4e92-a5ff-0375881cfc82", "indicator--aadf6cbd-ec09-40f7-a8cf-006fa1a27620", "indicator--e661d2fb-efeb-46dc-82e4-d4074dcd7bbf", "indicator--a98de438-08f4-4347-b863-5a22509acaf4", "indicator--f1fe983d-a5b3-4f91-bb9c-1e0d2d67cfec", "indicator--65f983b1-02c0-4dd0-b68a-e0335550422d", "indicator--333044c5-e986-4f1f-8ef1-0df3fac2a88f", "indicator--270c456b-a659-43a3-94c4-7b702ac6a7f2", "indicator--4220d137-d6d9-41ee-8c6c-45e48807c2fc", "indicator--60905cac-a115-45dc-8d92-20499843eef8", "indicator--4d5972ef-2bb3-4530-a5d2-95084bcda1fd", "indicator--3a259e4f-1c61-4035-a66c-9d81127848a9", "indicator--86dcf743-7ca1-4b3b-88a2-67092bd27763", "indicator--6d2f846a-98f6-4519-8a16-5546643cc66c", "indicator--906004cd-af26-4a63-b5ce-093e2094eade", "indicator--d429a5b7-7929-4c40-a269-dda6512bb4ee", "indicator--0b419a96-3d87-4fa8-9c31-51f003a9f593", "indicator--02c17991-3964-4662-8110-0aa226140436", "indicator--5076e75b-e492-4cc3-b884-57709fd6e496", "indicator--57df2756-9a97-47b1-a206-374ac12a52f2", "indicator--6f14ab6d-ee6f-4d08-9ba2-7c9a0a105beb", "indicator--3c23ca80-de49-44eb-af45-137e4de5b8c3", "indicator--8890ee20-06ee-41f4-bad7-aa85c484c4e4", "indicator--0ac3747c-d187-4f8a-b555-723437e6081e", "indicator--27b80304-b358-4f99-ac25-b5a206e517ec", "indicator--937eb0c9-57a4-45be-b3f9-3ca510f8b502", "indicator--c6bdd7a3-10df-4e7f-b21b-629ae97cc5a4", "indicator--e69ee093-76d6-4de9-a8a3-453ecd1e1e93", "indicator--a52e7b31-e4d6-417e-acdd-554df5144c78", "indicator--f44ecd93-07c2-479c-8f8f-9166d466b99b", "indicator--18cac9f3-02d9-486d-bd26-410bb02dc43a", "indicator--538a60dd-c09e-4ca4-af98-701f011e0e0b", "indicator--6cfedd26-2a2d-454f-a65d-f2e865d054fd", "indicator--6d74db75-38ce-4d14-ab00-b435ef168822", "indicator--3688941e-ffed-4a8e-a54c-be489f033a4a", "indicator--f06c30ea-6513-4f57-bfcd-3e8cdace1959", "indicator--59046ab2-19de-437e-9aa9-b468aea33a86", "indicator--3ea193d0-a566-45a3-9175-466453626e1f", "indicator--33c9be58-4a9d-4893-bc9c-20ea19335255", "indicator--8bb09026-f224-4f4d-afb3-f5e74a545fd6", "indicator--467896f3-5801-46f1-b80a-4201e84eb293", "indicator--699b82eb-ef7c-448d-b865-a44a59dafe07", "indicator--b87ca9f5-ed2f-453e-a0cd-2202c8cccdbb", "indicator--4ca75cb9-7969-45ee-8c1c-5508e3959533", "indicator--1f42d4bf-ee35-4b7c-9211-294c13d87f5f", "indicator--c17ddc5c-2b38-4b5c-a5b1-5d38b3a8e67e", "indicator--d1867ad4-2a91-45c2-bd21-156c7ccef651", "indicator--33a3fd99-c4e1-4044-8c79-902629a72609", "indicator--21be5903-57d1-4828-b49d-d459110fd573", "indicator--054a4aa5-78d0-4f9d-9814-0414efc6db26", "indicator--b3d4f4fd-b8a1-48d1-ab4a-f95839c4d2f0", "indicator--00ce5022-4520-4c70-a355-f90864abfa69", "indicator--82864ff5-79e1-4d0a-aa6d-6975325e8f1c", "indicator--96092b32-e593-4ffe-ac00-e60b4c320cf2", "indicator--d2cefd01-eba7-484b-bd09-1f453b8b2683", "indicator--a2c0f85b-9e87-4c7a-a3e2-2c35dd9d8e30", "indicator--b5394959-2a24-42f5-861f-0aaf9282a32e", "indicator--fce5d2fd-929a-4605-af88-c88db154542c", "indicator--fb9c6753-a937-4fac-8b2e-ccf1956c339f", "indicator--812649c4-bd06-476f-bad1-5f7e54494109", "indicator--f4803ffd-1323-44b5-b965-f75dcd00c5bd", "indicator--a9c612e1-c361-415c-9401-22d7895f6879", "indicator--f353998f-d364-4142-aa2f-0e5d0843e972", "indicator--ffb53644-2bb7-491e-9886-a43961d9d751", "indicator--d48d4a5c-941c-4d45-95df-255c3398e268", "indicator--40fe120e-5435-440e-8688-5a582ee95ac5", "indicator--dc278838-ee0f-4aa8-90b8-5288c2fcd02e", "indicator--64954978-278f-462e-b0c0-6be7dfc9f179", "indicator--f6545b4b-7221-4be1-bfe7-740231be9250", "indicator--31960f4c-f00b-4c70-952c-73d4261f12c9", "indicator--99951803-d967-4fd4-bea7-94f9e26903cf", "indicator--8f194416-ebbc-4c31-83a7-851aaaff9749", "indicator--27dd8f7f-d86b-43cf-ae3b-d4cca0319509", "indicator--4dbb9bbb-48e3-4c0c-8245-68fe4571e596", "indicator--604b5c28-d589-4592-8072-2fe2ddb79255", "indicator--9bd5b6b0-991b-47e8-9ae2-18727958c9a5", "indicator--10b9b665-8a65-49fc-9b8d-6321b6c9dffc", "indicator--7c3cefd6-c2ad-4bf2-bd70-18f895c74a8d", "indicator--c5585029-a4cc-4bb8-89f7-07d16ad88c49", "indicator--1a37abbc-c7b4-4b4b-a55e-062d0d8a91a7", "indicator--3a722e6b-1603-4fae-96ea-22cc2e163b15", "indicator--0a4bdb1f-2645-49db-8df4-b3855e833adf", "indicator--7c048d16-a1c3-4196-b08d-f3186e4dc984", "indicator--a130c37f-f926-439d-ac4b-c4910c9d0c39", "indicator--97773d75-14d4-42d7-ae52-daa46b596072", "indicator--f9c1ebf6-9918-4cab-afe3-4187b43a6f3f", "indicator--ac248aa1-7fc6-4680-a6f1-303f0eb14205", "indicator--64b1d363-de23-4837-a4c4-6a333551fc22", "indicator--6fd2fc1a-fc77-4d45-993d-7df2b1c814f6", "indicator--f3fc4797-5942-4be1-868f-aa5dd86982ce", "indicator--724f8a5a-707f-4b49-95e0-0bf310b196f8", "indicator--2f9c2ea4-8254-4930-978f-ce1705c199ff", "indicator--1e8ca32b-debd-49a5-b47e-f053aca5bd69", "indicator--b8e7784e-d2e3-4c5a-bce7-d267df8d3bc1", "indicator--4320152c-00c1-4fd5-8384-6a2e120c144d", "indicator--2616f5c2-8cfb-4618-8cd1-00733b8344c0", "indicator--11c2ef0f-2a0b-438f-96ae-a450f0784736", "indicator--3973731e-041e-4726-83f2-a321611482c7", "indicator--77f4d98f-40cf-445d-b143-253456991c53", "indicator--22a7e53e-a3f5-4bcf-bef4-2be4a02d3a46", "indicator--2c5b8f36-42c3-4952-b31a-2b5a93aac7a1", "indicator--eead6b69-f317-4507-bbd2-57e1f60f749f", "indicator--b9839972-b6d9-4185-b1e5-91cfa4218e24", "relationship--266c8ebf-9c1a-4c6b-9a33-9358af7032da", "indicator--0044cf50-92a3-4489-9f43-9c7aea38ab82", "indicator--9d0ab421-43d1-41e6-a07f-6a9a28a63bc9", "indicator--7c9a0252-c1a1-4c29-80cd-da5bccc56421", "indicator--fcf6ee32-ae56-4886-878c-42ae915fe607", "indicator--8481c46f-93ab-44df-85a2-b117e33ac169", "indicator--bdf36118-be0f-431d-b2de-fed5d7ab8497", "indicator--e545a26a-93ca-47c8-aefd-7f8fa66cb01f", "indicator--740a8c29-f2d3-4bb2-8b5e-280a8e3f0839", "indicator--d1ceea4c-c9c1-4b16-a9d5-a1eb83e5e268", "indicator--ce53dc50-11d7-44d3-b729-39c6b3747d98", "indicator--ff3dfef1-6466-4dea-acd8-5b743c83cf99", "indicator--3ea271bc-e51c-4b45-b695-b88ba7d38250", "indicator--a5cd4fc1-87bf-4e6f-b7be-994fe7a32ba2", "indicator--3d28ac2f-bc0a-4a7a-862d-3dd523358ba7", "indicator--9d0b0274-1d28-4202-8292-a5454baef96c", "indicator--4e3a7302-8770-4d5f-8574-5164dea87921", "indicator--b0193842-78e6-4489-86d7-c1956862af6a", "indicator--922d296d-f625-46b4-a2d9-976562a1088b", "indicator--62065d3e-018c-4c19-b276-ff53aa5ef3e5", "indicator--a190b905-c340-4e12-b358-fdd5341bd3fb", "indicator--35ba45e3-dfd1-44d0-a641-b8668e18c595", "indicator--f01e66f8-05ea-4617-a150-bdf79dfe8cf1", "indicator--827f32a3-1ef7-44c9-a346-8cba2d71b72e", "indicator--5246d6ec-40e4-453c-be93-6a4d8e42a300", "indicator--67fe9f14-6a4c-4688-8671-9809bd071163", "indicator--4494a5d1-4a1f-49f3-8189-44a9ffed53e1", "indicator--b793bccb-df43-47ec-8e43-9cc4516f04a2", "indicator--f7c447e3-af9d-4564-ab01-e2ab4535392d", "indicator--4079266e-1e7d-440a-8ba0-43f7ef3ed43a", "indicator--91da1293-112b-4d57-a519-000042d19af9", "indicator--ae0fbe1d-2132-4e0e-9994-e9f5aefa159b", "indicator--44eda4e7-4571-4c37-b054-efe1ba432235", "indicator--ed7569bc-18bb-46fd-8744-01a9adce5e96", "indicator--5b85cc5f-ac02-4ba3-9f6b-c89f36b59a6a", "indicator--d56165ca-cd8c-43f1-bf42-988801f5e970", "indicator--54cfeed5-dd6d-474f-9830-f2a53f4f9f17", "indicator--a9ab8a5d-cdcb-4749-8dc5-fc758809f5df", "indicator--d04b1f5b-9f30-4bee-9d64-9699636600dd", "indicator--d1b5b98d-8ca7-499c-952d-a1b424ef2446", "indicator--dc97a9e4-106c-47f0-bec5-dd596103f697", "indicator--de3afb64-8d5c-4e50-b16d-7db8f423ede5", "indicator--5927a9c2-1f16-4582-95bc-97f7b6ae18ca", "indicator--d5a135f5-4f79-48c2-b138-e45e6304530f", "indicator--40027931-19a5-4a28-a3a4-a09fd1472642", "indicator--7a39ddf1-afb9-4fe3-b02a-54da0be995f9", "indicator--e84842a1-6278-44ae-9218-a73d147fe5bf", "indicator--302f2511-267e-41e2-accf-b0c43cc9da9a", "indicator--492226d0-0785-49fc-a792-8bf3281152a2", "indicator--56b3cedb-ba17-49d0-b11a-930794db91a8", "indicator--5c3ef66d-a78d-4b07-87d2-d367eea54060", "indicator--e23bd824-72c6-4932-9d41-87e595bc7898", "indicator--401af01f-897d-401f-a14b-6f0ac60db301", "indicator--2172f6c6-6580-4386-9f79-ac4b5f7c4b33", "indicator--fdfa6f99-ab1e-48a5-84fe-4f82944d76a9", "indicator--08706cb1-650e-4236-9e90-e0f6a2b530ab", "indicator--86dde5fd-5a77-4f9e-a3d5-9c89751161de", "indicator--8e51639a-19ec-4907-ac06-0decabdd19c6", "indicator--a6fe6265-6c3e-4b2d-a2a1-c6ee21a6d6a9", "indicator--cdcaf870-6baf-43df-a0d1-7d72311c0728", "indicator--2e12bcec-5c2c-4951-bca0-9a1f9a4d79c9", "indicator--01cf12fa-8239-4aac-b13d-0ce887ef3614", "indicator--857b1d0c-219e-4464-a9f7-5f3bb519026b", "indicator--5eb6bdb4-0406-44fb-ab84-59c3464d2a9f", "indicator--fb3758c8-2376-49c2-abe4-f6fcff2a9b32", "indicator--592d09be-16d1-4a5c-8bb9-c414233dc9b7", "indicator--ec56938f-3c2b-4e34-b688-dad591439b09", "indicator--cb85acca-e023-4337-a118-247e2f78cda1", "indicator--c4568a56-828c-4ede-8f4a-19d44dbe92f3", "indicator--6df30506-aaf2-449b-91b6-b316eaf2809d", "indicator--11025c08-5d35-4643-9b5d-0ca280ebac8d", "indicator--8cd7c6da-bbd4-4aa4-bc4e-843e6f3e7509", "indicator--37c57240-ce3d-4fdc-bcbc-0211f02bcdeb", "indicator--c1fcebab-f26a-4cdf-9ac8-d47be35ab185", "indicator--64d6e251-ccf8-455e-8430-1af75a5eb3f8", "indicator--26b0d164-0802-4bcb-b7d6-c74f37ff8d5a", "indicator--f54f5d04-225c-49e3-80b2-8f4f10fcde44", "relationship--2c0e92bf-38e9-448b-abdf-16526e5e9e65", "relationship--8ec04b73-802b-4a91-9343-e061b6c7b770", "relationship--ab3f0c8b-f612-48c9-bef2-5a6185087566", "relationship--aafcbf48-51b1-4314-b4da-0d57473d3b05", "relationship--e39d1dd0-92d4-4e0a-8f5f-d9a551167234", "indicator--6d5f6592-b749-4052-b07e-616159074f10", "indicator--fd140337-8634-4e8f-8667-66e832be8376", "indicator--55545ad2-a967-4281-a19a-9ae776bc9f94", "indicator--77a195c7-589a-41c4-bdec-7f92501e4e9c", "indicator--f121f310-79d8-4dbe-8022-40d810dcf589", "indicator--f4d1ab55-7418-4227-9f0d-d41e9977334a", "indicator--a984f8fc-4453-4a25-84c8-cf71df7f8708", "indicator--ba564948-8902-49d3-83da-0b6b67f4e985", "indicator--74c34f74-14b9-4cf4-a772-ece15d554b69", "indicator--077b5bd3-a27d-4f56-a2fe-c39442c61300", "indicator--e9c0a34e-09bd-43d8-850b-157ef91d8573", "indicator--f05040e3-54ca-4012-9430-2fed23a5563e", "indicator--725ee357-732c-4ce9-b7b7-4e1c6dad3b0e", "indicator--f3d164c8-9b6c-45de-a788-0ac180211115", "indicator--3a630703-79ff-418f-8028-168009fdb49e", "indicator--c71db7fb-4741-45ea-8c0f-6f21c3da4863", "indicator--e4f53709-e4ef-4623-acd6-d27898ad5a36", "indicator--c221b732-a538-4532-87fa-21ba3637540a", "indicator--72a2ce36-8470-4b91-b6d7-3b27780c85b7", "indicator--3aa0a558-15ff-4a07-88ec-3189760a3057", "indicator--32f8fc85-f5d1-4dd8-b10a-a3151b4970bd", "indicator--0f05e176-c0ce-4ca7-bcd5-32bba84c5ab8", "indicator--0b24e536-e66b-453a-bf43-8266d9907828", "indicator--e3a444c9-51d1-466c-81ec-da07f3f069bd", "indicator--87529c79-eb8f-42eb-b302-9cd9f8ace564", "indicator--e3e57821-95db-4d38-b1aa-3e4b445af29c", "indicator--14d29567-1d9f-46d8-8ed0-cde37c211c24", "indicator--f22d1814-9e9f-4866-be7b-b8e7cd8efb02", "indicator--48c02b65-7586-4d9b-8694-e40370ea177f", "indicator--ba5e1747-96b1-4f96-9170-cfe62bbc50c4", "indicator--f8420ad6-8ad7-49d0-856c-fecc94c109a7", "indicator--729881ce-23d9-47d4-9df1-e713d641a324", "indicator--241dc9cb-a978-4bbf-a70a-77abb59b662e", "indicator--4ca3fc56-673a-471a-8d94-527aad91442e", "relationship--c9b54e41-e7e3-46b1-bdb3-df0e44331fb6", "relationship--cf211db7-ab7c-47e5-ac1e-52c8c0a97ecd", "relationship--d75c1210-ed16-4d12-82c5-e0b40ee51ecb", "relationship--3f628f32-b80a-4ab8-aed8-4163f52391da", "relationship--8ef0bf14-86ac-46fe-842f-6482274dc080", "indicator--42919588-762e-4e75-9727-c04fcb3a7019", "indicator--925f73a3-7cf1-413a-9d98-6bd2ccc17fa0", "indicator--4309eef1-319f-4ef2-acec-4d17651ec24a", "indicator--3fc0ccf3-7eed-4ebc-9e80-9a360856b1e2", "indicator--7dbcae89-11c3-4dfa-a4f4-361129b4659b", "indicator--f86b517c-58de-45cb-9f5e-dd6c451756b5", "indicator--b3b0fb6e-2d7d-4734-8587-124be26619b7", "indicator--3dcc7750-fe81-4c00-8e0f-ca9a0afcbb88", "relationship--f22de167-d00c-4804-a9fa-419280b68b95", "indicator--a335c040-0ea1-457e-abf6-71a73628acb4", "indicator--5d46ff1b-fbd7-431d-b75a-ae25cd167ebd", "relationship--55fb04ec-d862-44a1-8a45-51f30d9a3eb1", "relationship--229debea-03eb-4f0c-9efe-e5ad4a64dbd0", "relationship--1e0ff8ec-cd10-4f92-bf7f-4b7fe5a3b5b3", "relationship--ca83cdda-5f19-44b6-add8-d9099fa2c509", "indicator--17bd7a88-c828-4030-83bc-162cc2ac78df", "indicator--36c817e4-5689-4421-a3b3-557d70e79e4f", "indicator--d98fdcd0-fa8e-4c20-9628-bc668416088f", "relationship--8adbbdef-feb1-4f9b-9ec0-64991070f55d", "relationship--7f65b0e2-ec43-4f38-853b-f28547a6c037", "relationship--0e0b1a0d-c1ad-4df8-adee-a118c8f2cff0", "relationship--31487b3e-4d84-48d7-befd-58a60845e6c8", "relationship--a8c56f10-b736-4ef2-8fe4-3f41a05c11ea", "indicator--2e1016b9-9e9f-42db-ba43-1becc7c6f408", "indicator--bbecfda7-96cd-4068-ac66-52ac3ecb5d35", "indicator--c30aefd1-a1e4-4597-805f-c489aff5394f", "indicator--a73f6877-7dfd-4475-a321-34998d27d2d6", "indicator--f13aa69c-7222-4de7-a4f6-36c4d4575ce8", "indicator--a153a7a8-0209-4bff-b5a8-48bfa4c8e4a2", "indicator--a2f686a2-b6b6-486e-a0d2-dcf109a322e6", "indicator--219e0ce0-7d18-4e83-9058-4ec268bc3c0f", "relationship--c1cb5ecc-b507-4716-8b62-ba5c900b1bd7", "relationship--899e706b-ec6c-40bd-be5b-a9197eec06ef", "relationship--33cadbc3-baa0-4ee7-b2d7-fce1bdc658ee", "relationship--675dd3c1-0be0-4b92-8d48-e16d67b9f897", "relationship--e4dc7fac-24ae-45a9-8bdc-65f8be67952e", "indicator--f012d293-9e5e-4354-b456-2406e036d976", "relationship--5e89127e-df84-42e4-bfdf-8e255ef5b124", "relationship--b3eff2c5-224e-439c-bbd1-31d00dcd27bc", "relationship--84aeb30f-ef91-49a2-ba58-983be001213a", "relationship--0242dd22-53cf-45ee-90ba-6a6b536d329d", "indicator--0599354f-5ac0-4a79-823f-9a2622205f72", "indicator--9bbb6038-2af1-4ed8-88e3-1f8555ce1875", "indicator--592e7b76-ba3c-40b9-9a1e-19281901ec05", "relationship--9780554c-8811-4311-8105-d08a0155103f", "relationship--07dec755-c9cd-40b0-93b1-05868d21087c", "relationship--c5d1c8d4-79e3-4b75-8b83-04cad6e2b2e8", "relationship--a7e1e3e8-fdc5-4149-b955-fef8ceca6769", "relationship--b174b0ef-92b3-4022-9f09-8de8ec012299", "indicator--6a767edf-b470-44b2-b032-5c26243300c0", "indicator--50d70d5e-a9f8-4ceb-998f-b89e75088deb", "indicator--dd5b3a8d-52df-4602-918c-f447cc0bbbf5", "indicator--ee8e40b1-4dff-46dc-b558-146f4f2e8122", "indicator--f1f2af93-1148-42d9-805e-ac9320e714e0", "indicator--6d0bdb7e-175a-4bdb-9e66-10bc639519f4", "indicator--1c33bcfc-fff3-41c9-ae85-9e3f8fc879fc", "indicator--a35541f4-0467-4377-8bff-11bf7cfdb455", "indicator--909b4c84-80c2-4573-8aba-173ca3a33984", "indicator--8728bc01-eaeb-43e1-a488-6cc15a22f5b1", "indicator--661c5c44-6f89-42fa-8aaf-a52ea7db2be8", "indicator--de021dda-b388-4cd5-a2ed-32ab88b16587", "indicator--f3118753-e93c-4289-8c29-34d7fd9cbec7", "indicator--a7994d73-7aa9-4b60-a452-1c315d510e6e", "indicator--f09ecd30-9a5c-45da-8f68-4d0f4bd576fa", "indicator--fa60d159-003e-486f-97be-d786890c231a", "indicator--5ad4dbb0-c18c-4bb3-805f-db42abbe8102", "indicator--067e2167-b656-4fb4-a6c4-eea168f14f8f", "indicator--1b80b4b9-0771-49dc-8ed9-e9f20b272f45", "relationship--7bbd136c-e18a-4ce3-b8db-6bf68fa35fed", "relationship--48122c91-aa48-4ac6-8320-5a409777c2b4", "relationship--7bb3b870-63af-424e-a483-e75c3d05b722", "indicator--96d82c7e-8f81-4068-8091-d72116c60063", "indicator--f555d81a-0950-4960-8683-88e5178ce1d4", "indicator--15603be3-d8ec-4e57-a451-84d30331ffaa", "indicator--22e084ba-23b5-422e-8b91-4dff775e1f08", "indicator--68ed6345-85da-4572-bbb5-5f83250e2cb3", "indicator--7fe7aac2-38df-475b-a326-e9c932ba37e5", "indicator--30147632-3c09-418e-9217-36e0ca73d29c", "indicator--a5c2da55-53b0-46c9-b93d-f990f94171f6", "indicator--05dcf205-df78-4989-ae4a-b6b581d4f67a", "indicator--7e70ee3d-0c0c-4525-a968-8c05a11a5379", "indicator--1a942933-1d23-45ef-9ea3-32dcd50b40a0", "indicator--5020469f-0a03-4ac7-b348-86b7f1bac8cc", "indicator--d234d4c2-81fb-45c6-a356-674a667369b0", "indicator--0e6b999b-1ccc-43c7-919e-e6cc67214b91", "indicator--86533ed6-9484-46f2-9493-e538ad4b9586", "indicator--7821d584-897b-477a-b2aa-7c2ee560e3fa", "indicator--0d16d738-b10e-47db-ba53-0f92790550cb", "indicator--a91c9e21-864e-46b2-b734-d213cfd734f2", "indicator--6d9aba84-dd95-4516-a395-bf2b88b2cceb", "indicator--7fa19dac-117a-44e6-ad75-9bf5c68f70e6", "indicator--6601446c-81a3-47db-8c85-c31915a5c0f2", "indicator--3a35ef9a-8e90-40e6-badc-47d639e18aec", "indicator--8e1de570-a4ee-4fac-9602-8bdb7eb477c7", "indicator--36b77884-8114-4256-be6f-1efb660c2bb8", "indicator--d4777544-4c90-4365-b2ce-5cd922cd7758", "indicator--b04586d2-a64b-44e3-a2d0-9586b8da2b57", "indicator--8b5084ee-f930-48c2-8d55-76274cb8192d", "indicator--af230f8f-400d-4820-a4b2-71b36805ffbd", "relationship--1aa7878a-51f4-4ab7-9624-22a3ec451c36", "relationship--10a5b1ea-f62c-4e74-b69f-5eedc71ac769", "relationship--cc53b923-c6ea-4406-8edb-15a834ce2b06", "indicator--adb522e1-2721-4318-9e6f-c8d5ed3e5181", "relationship--d38960e8-7975-4dc3-8db3-659c813a07f2", "relationship--1400a703-8c6d-4e73-a076-e9b07e0460c2", "relationship--1469bf10-1a17-4e26-8543-7d1e6041b0c7", "relationship--54a08f92-7c67-44e3-98fa-4d69f82d3d57", "indicator--97bfe6cb-6610-4967-adf5-75ee69ccd2e6", "relationship--a9a9c9fc-82fd-45e6-b521-8b92c2ed117b", "relationship--74cd46b5-e645-4ebc-abb2-bc0fe0b87a8e", "relationship--2bdca3d4-5981-4dd3-afb4-78530ef160fb", "relationship--1ace3998-c22c-432f-ad41-8418c4202195", "indicator--a1608d65-a08f-4e4d-90bf-1726746b1974", "relationship--0d844cd8-299e-4c9b-818d-27a42531dc8f", "relationship--a5f5477c-d1cb-4874-b376-d28f13c0b1de", "relationship--ff7d90c9-cda7-4a3e-8167-deafa8aca97f", "relationship--bbe37c85-c28f-449a-bc17-012b9c5eeb51", "indicator--efab0b51-0cf9-4535-9873-ca8f76a53b35", "relationship--996ee511-753c-4074-9538-7aa5d1a49e01", "relationship--5381d988-6177-4413-b0ae-d385c048c947", "relationship--e8cb1167-8e27-469f-af8b-4368484a222b", "relationship--294f65ee-b64e-4d42-9719-e843494fd5e3", "indicator--4e668044-abb6-4304-86af-82762fba0bf3", "indicator--42ce6b9b-acb6-4fd4-95d7-39292af6eedb", "indicator--660ee482-eb8e-40c8-ab3b-9af33e7f6fe0", "indicator--0d767142-04d3-4283-8886-9cdddd7bdbe6", "indicator--463c381f-bee3-406c-825d-7a435d3afe1a", "indicator--690dadd1-0b2e-4ca5-8c7e-2841c88b3830", "indicator--481a85be-3494-4f3d-9946-fbab10df8340", "indicator--3aa64438-9411-4d3a-803d-9a9c9e1192cc", "indicator--b1664202-c068-45e2-b783-b0c8dab55c5e", "indicator--f207241d-e160-4066-83f1-5f909db508c8", "indicator--35729941-6854-43c6-82fb-7a94b877e7b2", "indicator--f1d963d2-0819-4861-ab42-555d0be5ccb9", "indicator--f5f227df-7fb0-446d-bd9b-274c4a71a432", "indicator--d7d4eed0-ebcd-4f9f-89bc-e20857141e4d", "indicator--ceeac1d5-41fe-4f0b-8ace-0d0946bc4995", "indicator--f2a74139-ec3d-44e9-87d5-315cc69dbd65", "indicator--949df8a2-6f8d-46e5-8c87-b442a2bdde1f", "indicator--395d5823-c71c-49bf-a535-b8a2ac03dd2e", "indicator--a522a541-a598-4366-bd5c-285d701f53d3", "indicator--99e10663-dec9-4812-85a7-d9398e281998", "indicator--f4bb8c89-eb06-455b-907a-6ac4f2992242", "indicator--cb39122a-b233-47da-b7ce-33e1ee8f5556", "indicator--4ce03f86-abc5-45f5-8fa1-4a51e4c72e7f", "indicator--b899f1e5-9c01-4bad-9389-244f3656b74d", "indicator--5e037289-f1eb-4ae6-a4f2-5175274f2b77", "indicator--01cdf582-d417-4eb8-b1c9-0ee005415f10", "indicator--ef8fa32e-7a1a-46c0-a0c5-8fd452276089", "indicator--7032018b-81da-43a6-b51a-ac9244f890d4", "indicator--4870df7f-df89-4876-97c0-f6c4f2951eed", "indicator--29846599-2a13-4ae6-a22e-76c9a4a345f9", "indicator--b87019cc-67ce-436b-b1ea-8b2be7b326f7", "indicator--aab00e98-5b02-4c46-b7e3-0a7b37932f90", "indicator--d76b25cd-8750-4f4c-a424-84616295c95b", "indicator--d94a71c4-4349-4b2a-a0d0-946bc2bcda2c", "relationship--aff62d2a-0dcf-43be-b354-7b9517ef4158", "relationship--3a9775e6-75c0-46e8-9988-6790459c13a2", "relationship--fd420b78-1bf0-4fb6-bdf8-0dc60edb8fee", "indicator--54669bc6-acb3-486b-a637-5159f946889d", "indicator--2e6a16e7-c653-4c7d-a8b6-a849438079a6", "indicator--d4816875-f8d9-4c57-b8a4-18a746e34c44", "indicator--8e935e0e-b049-4a86-8c51-d66c96fc0e1a", "indicator--537ca114-00d6-46ba-84df-499375b4f1f1", "indicator--e749ce42-0b2a-468b-b78a-117454142bf9", "indicator--7e818ecd-6769-4605-ad57-90cbc4ed055a", "indicator--ca36f6b0-fc32-4363-a3bc-a8ae68fb5ad2", "indicator--66504773-c65c-4d78-b0a9-dcb00df63e08", "indicator--f3095c86-67f3-4540-a3ba-9e2b67a8bdcc", "indicator--15701a80-627c-4bdb-8ace-f55cf0408117", "indicator--ff3b4df2-3bb2-426e-a402-ce38d13409b3", "indicator--47394f86-644a-4e0d-afed-60a13556e2b4", "indicator--87ba77e7-edf6-45a1-99bf-2f0bbdac2fa7", "indicator--8b77afd4-486e-4ab6-96e2-2c23068fac29", "indicator--ff40c11d-505a-4685-9884-7d682f79171d", "indicator--83c81187-6266-4b8d-969c-7947382bee22", "indicator--40eb05b4-06df-4a04-9035-5a84dd4be128", "indicator--c6e48b84-cccd-4e0f-9d02-df9329ec962a", "indicator--6f71f491-76b4-4a46-86a4-32888708171f", "indicator--1839671c-dc8e-4cc0-9c4b-72d96e30d44a", "indicator--c8789e48-4ef3-4c68-b462-663d0e0d6778", "indicator--5ec86b7a-f835-4eff-a174-67a0cca85fd4", "indicator--b66489ce-d502-42d2-9a88-77d14665279f", "indicator--dad8ee49-bbd6-4b41-8f87-b9787f62109d", "indicator--84c9f04f-a082-4f88-8047-4796abc48857", "indicator--6e5dcf05-882f-4e76-ae9c-d20e35e9abc9", "indicator--31a4dd72-ce9b-4e0f-8e30-6119b2c49f63", "indicator--da5213c5-9a62-4051-b6e2-7f18e5ba5b4e", "indicator--58478969-d200-4235-aa26-b029698e5cdb", "indicator--6f334cfa-65ae-4567-aabe-dc139fc03317", "indicator--79f4f338-bf90-496e-bdd3-902686812d0b", "indicator--98c9f08d-1c85-436b-a1ca-7d90417d815d", "indicator--1cc30962-14d6-4df2-adf2-0cefef107df9", "indicator--6b60505a-6830-489f-9d8e-b869d744b94f", "indicator--089323ab-8f78-40a6-b8d2-5c1ea6082088", "indicator--affe2c03-608f-4652-b475-930ee35fd734", "indicator--201f041b-c9fc-4c0a-9e05-fba3e7d7fe83", "indicator--c4a3deff-8d61-4d6f-950c-c74280f9354b", "indicator--90f786a2-2532-4737-99ad-af9d7eec5ea9", "indicator--b67dbc15-44cb-435e-9512-c4a6ff790ebb", "indicator--a97ea7e0-ae21-4cbb-96bf-787a2f3766fd", "indicator--0a570bd0-ca0e-4b82-909c-53141f51664a", "indicator--b7d39e25-f48d-4e45-8360-caf6049f17ee", "indicator--7856c57c-b1f0-485e-918c-496195f780f2", "indicator--871cec43-a0c4-4e5d-8edc-665b3ed16e47", "indicator--53e9c1ff-0cc6-4f31-8752-dfc8d60a9fa0", "indicator--980504a4-f151-4166-a6ce-fd1b5f4e34cc", "indicator--9f02eaf0-83da-4b88-9c34-c074c5a2ee6f", "indicator--c630fcbc-fb20-4705-9214-a2b8014c679c", "indicator--f2fc31e5-2a8c-4c59-b43f-95e13def9c79", "indicator--554d6629-36d5-42d9-a24a-28b4e646423d", "indicator--4921a2d3-709f-4767-b373-5536e71ee03d", "indicator--f0b100d7-eefb-484d-8c4d-570019e86c6a", "indicator--739a0c9e-4fb9-40b1-ae66-1694609e4fe1", "indicator--c815de4c-fb41-4f87-8c6b-372b7749a3dd", "indicator--21ecb4a3-3d68-48bd-813e-c08dd503e85d", "indicator--9569142e-b9c2-4ec9-8644-65dc9b983ecc", "indicator--b102672e-7b49-4267-a806-3360ab5797e3", "indicator--b1669316-f0ad-416a-a122-149a9c49eee9", "indicator--a8106ec4-e564-46c9-8590-3a770157d479", "indicator--726869c0-c158-43cb-a2e3-a869945850fe", "indicator--2fa861c0-58ed-44a9-8886-5c098d0964c9", "indicator--c09488cd-2d33-44b3-a84d-2d8b6f6a5295", "indicator--33b9e267-dc7d-4220-9111-c4b5f5cecb1c", "indicator--26077318-1cd7-494a-90db-49033073e81a", "indicator--15655759-f3ba-46a4-ace5-f2cda289ee04", "indicator--63a851f0-a0dd-41b6-8222-fa1c4245ff97", "indicator--12803bfd-b9a0-4150-be78-6f2d09826f12", "indicator--ae499131-906c-400e-a7a8-3062ad8f63e9", "indicator--eef477f2-18f2-4393-8738-6b3e74d9a71f", "indicator--686cb09a-d42c-40c4-8730-406e0b3de65d", "indicator--6360a326-81ab-4c2f-bc26-7d623e5f4573", "indicator--b9e7fa80-8f5b-4393-8665-f710673c1158", "indicator--d3db204b-58bc-4e23-8467-d6481c8f2ad5", "indicator--73e70771-301e-4d19-80a5-04c821080a27", "indicator--f5e17f86-fd0e-4d5d-93cb-db048b2e77a7", "indicator--bca3a33b-584b-4319-970b-5614505abdf6", "indicator--f729cf5a-56fb-4030-9fde-ec2b945360fb", "indicator--0b029f6d-c7a6-4634-98e2-2a9f8d491c83", "indicator--7b079eb9-2d93-482f-8199-0c4ec02eed78", "indicator--ebba1e51-d163-4e36-9855-b6cb9bdf6a09", "indicator--8ca998ce-c18e-4a2f-9461-1cde16b0a41b", "indicator--b487913e-94c2-47e9-a589-2f2757e9eea4", "indicator--26c8989a-3171-42ee-9766-53fb732e93f8", "indicator--67601c15-f155-4ca8-bfd2-f667a5edff21", "indicator--778dda81-88cb-4b8b-9672-92d6febc51b2", "indicator--1d756bba-2d8b-459a-a193-93659cdabb33", "indicator--7e1c3d68-4422-4097-b06f-70afbfaa879b", "indicator--7ae57f42-609c-4438-af2a-4b7c47c32154", "relationship--3266f95b-1124-458e-a097-00de7252f39c", "relationship--3f0de7b5-7fbb-4fe8-a9d7-b5e24e66c7e2", "relationship--9fd55468-64a2-43b8-8b57-1f7f80cfa602", "indicator--f2e270b2-a84a-4064-a93c-9f47f622197f", "indicator--9081871a-41cc-4390-8952-2c1bbf5c7323", "indicator--ac16da56-db49-4ad2-b588-e7a70195475c", "indicator--8ed02201-dad6-47e4-a153-f81932674d7c", "indicator--a7f8a2e7-d4f8-44da-8448-902139fec3d6", "indicator--a430050b-288d-4d62-bdf4-e2d3ebc159f4", "indicator--4f6f8078-ca0c-490d-928f-89a41f28f2e6", "indicator--63a4688f-3360-4595-a73d-5a48aa3b6bbc", "indicator--652651bd-83ee-4ba2-a5bd-6880a92de220", "indicator--ff328077-03e3-4294-89a6-b41d9db600ce", "indicator--790e77ea-fa3b-4b37-8a40-6f25887b54b5", "indicator--b28d57af-bac7-4a4f-8ccd-3b3bba1aad57", "indicator--9940241b-e3e5-4824-b6a5-c5890295626a", "indicator--bab63175-5ddd-454e-b45b-a7c3836b86b2", "indicator--b1ff378e-dfb2-4474-b20c-9a0d414ebe27", "indicator--dd9353fe-2512-49cb-9921-047aa5c34a81", "indicator--4e40ec8d-6ae9-481a-b70f-fbdc03ef773d", "indicator--9f3f4e49-2dfa-4e3e-a3e2-4884b7b007ae", "indicator--bc2a0586-40ab-4cbd-8a09-176200a39083", "indicator--003813ce-7944-49c2-80bb-0674b688339f", "indicator--c945287c-fde5-4dea-86d2-c1e453bf1bde", "indicator--acfbdc2b-c0f6-4009-83d4-59d756406596", "indicator--fb60a0f8-b67c-4738-a02f-1a0932485535", "indicator--15c8cc24-bc85-49a6-9450-a1cb7a718a6b", "indicator--e96966ca-0666-41e8-914f-589b37300bd1", "indicator--001f0b3f-e30d-4ecf-80ad-d70e28dfa875", "indicator--76515519-6da4-4ad2-a8e2-8aac830d7bf3", "indicator--1b7df1ab-39b6-47db-94ef-9556c2efebb7", "indicator--f36219e9-6d31-4781-ab7b-9f4cec4ca0f0", "indicator--72010ce8-3735-4531-88a9-dec3c2f3d5c9", "indicator--4c8a49cb-3d66-419a-8aab-80ba2014a386", "indicator--05f00bef-aa72-4b7c-8e24-d3ac6e446df7", "indicator--4a2aaac1-516f-4ebf-8899-a7453c18e205", "indicator--d4834a09-e1b8-4f52-ae30-c5876f0d63a7", "indicator--996ff60f-2061-47bf-ae8f-92762d469ee9", "indicator--7cd399b7-6c88-4d22-8950-a1d3c56b84d0", "indicator--b2a21223-0e13-4b0c-a6b6-70ac3f810c58", "indicator--9d9bca2a-2a5b-40f9-9d37-40d7bc0e22b5", "indicator--dfa9801a-cbe8-4d8c-aac1-78b016d2ad23", "indicator--720ff5e7-a2f9-481d-9ddd-3a9608a57b28", "indicator--cd7a21c8-775f-42ac-8265-c931bc0d9674", "indicator--e235bf7e-a0d2-4090-b26b-bdb1b6262484", "indicator--1818ac56-0582-4b3d-84b7-02bffadb7952", "indicator--067f08ef-3ec2-4235-9c9e-4809cbc6df01", "indicator--e84cae8b-9e33-4c31-b56d-dd1b76f4781d", "indicator--e42373dc-c017-4883-8a7b-685342e7d77b", "indicator--1fb2c868-74ef-42a6-a6f0-4b6184c61839", "indicator--56a6f80a-4515-4d00-b012-4eab5058a8fc", "indicator--840528f8-a4dc-4b50-8dfc-9185ab1bca2c", "indicator--bce0f43b-d0d5-4127-a22c-0bd789e7a1ae", "indicator--a56bee91-a706-400a-b834-d8f238565adf", "indicator--476600e9-582d-4883-9d5f-e579e61e6ab2", "indicator--993de8a9-a7e3-4299-ba1a-000360cf3911", "indicator--5093e6ab-254d-409c-afef-2c9c9a84e59f", "indicator--40cc0404-c448-4986-a1b0-c2fc0e8eb96a", "indicator--2f3f7983-6fac-4a96-95aa-eacd2dea45a3", "indicator--f5dfea57-3ff0-4454-bf40-938d8b2ab20e", "indicator--02902cff-7eba-497d-a1a1-e81ce860695a", "indicator--eabcd843-cb21-408b-beb9-a7f7c4943131", "indicator--cc7cc57c-d73a-4f00-b5f0-fbddea9a5d4b", "indicator--3b631351-9a70-4f6a-b02f-6a479e3cb97f", "indicator--e250b048-2b02-4bfa-a98f-d2e5b52b9c17", "indicator--34c73e78-9756-4384-be29-9e0ec5c39fdb", "indicator--531fbbaf-f4ec-41b8-a551-46632fe719da", "indicator--7b3c5ccc-be74-4a7d-aff3-05156c620aca", "indicator--353ac4cb-a7e9-4e3d-abb8-f3eb42cda874", "indicator--97df7f2e-6e31-422c-807e-0833bb1d2c76", "indicator--3799bd84-728e-4a1b-b239-4f7329955db1", "indicator--5134399d-56a1-4f52-af18-1dc3d59604f1", "indicator--f8b3420a-8d86-43e4-8981-c6e5936b5311", "indicator--a62ad187-9f3b-4fa8-ba1d-760dc83e2065", "indicator--0a511e28-27b5-4fe5-a761-73a6aea6169d", "indicator--79f53216-2a83-4df9-8999-ae2d0efe48b4", "indicator--f76bf7d4-a3da-49a7-b37e-638b31e35472", "indicator--2658df3f-4803-43ab-bd4d-fa0d21521d91", "indicator--0bc896f6-58d3-467c-bc0d-a0dfdcba123f", "indicator--f98fa4a7-82c6-46ea-9953-719e6e414dbe", "indicator--4b4e709c-1aa1-4396-aed2-be17ac9aa24a", "indicator--6e755494-a9ff-4af4-b76f-33fa80328fd9", "indicator--eb04465f-65ef-41be-ab20-61da9fe0fd61", "indicator--db7766a0-1b3a-4939-891a-c1b7560e1792", "indicator--9de4cf43-483a-4152-bcf9-1ff855c684f5", "indicator--093f1235-8b3a-4662-9450-17900cd4934c", "indicator--cd10ce16-df2d-43d1-a67d-2e55214f8a17", "indicator--1727abf7-c93d-4f57-90f6-a52570f242c9", "indicator--313c00ab-0e73-48f5-b492-48af194cac9f", "indicator--c92a130d-64bb-4d8b-8fcd-2cebcc28b732", "indicator--97c8e339-eb90-4892-910d-75cdc326a144", "sighting--5d365af8-8e68-4701-989e-38f594465fc8", "sighting--249bf87c-5390-465a-8cdb-9b4101df52c9", "sighting--2e968248-2e16-46e3-b239-3e26e57f1151", "sighting--8679e1c8-2773-4383-b084-feff6aa82e49", "sighting--9991e52f-45c1-46c3-b574-06b313586186", "sighting--8a8895a1-1601-404a-98e5-01eb7e958bfd", "sighting--b88791d4-b64d-4617-b26a-c9ad32917062", "sighting--45dd3f77-22f0-4b06-b75c-02a0a5361040", "sighting--8e98e8cc-6965-4c87-9d6a-a3fbf6f9ad0c", "sighting--41817557-5b26-457c-a86a-f2a6b1e43819", "sighting--cae4afaa-a143-4af0-bce5-6916ad9b43c8", "sighting--044f34c6-3a35-4274-8365-819c8447968d", "sighting--6e64a5a1-8266-42cc-8e00-f16149643c7f", "sighting--bea6e2a7-57b6-43a4-a46a-30ac61c7a27a", "sighting--0c9a3bcd-984d-4be4-b1f7-4f8c76a71bf6", "sighting--622bacd3-3674-46d2-a120-5dbf99b481df", "sighting--9460aa65-d3ba-4e18-9d21-67b1ab1688c4", "sighting--a2ae3259-87d2-452b-967e-aa4ce6a88d32", "sighting--75f0dcfe-b298-4651-b970-12eee7c395ef", "sighting--d4a4ab62-5eeb-488b-aece-0564a622f2cf", "sighting--f7abf168-1db2-4f65-ad97-79379886c53d", "sighting--81de7c65-24bf-422b-aa59-08e0d2f53fa8", "sighting--978cf56f-dd46-4aaa-be90-b95f8a4a61cd", "sighting--45d6c491-3505-4fae-b8fe-1ccbf72753c6", "sighting--afc5c34c-57be-405c-9f8d-7a71de45f680", "sighting--f2bd5cda-8b3c-4a61-a11f-dd2aca35c2de", "sighting--58745dff-197c-40bb-8640-257b4d201fac", "sighting--2fb99443-fe08-4b80-bbdf-f9e7f7962849", "sighting--ccd13d9d-1903-47d0-bbe3-36a5add61a76", "sighting--b7e571de-e09b-4a30-bc82-038cdc5895a0", "sighting--db70de09-053f-4e28-84b9-8c423d055048", "sighting--db33cd84-1792-4f67-8a93-101740926b91", "sighting--99404dcd-74ec-4c89-8fd8-3154e149b312", "sighting--94170c9b-ceda-4dea-a5be-eff59116239a", "sighting--dda0d07e-2fb7-4100-8d41-3c5524e7f5d0", "sighting--0178a529-adb0-4378-8a70-4110088dfdc8", "sighting--bc08dfba-bbb3-44bb-854e-c879a4c05deb", "sighting--d66f626b-106f-4baf-946f-cdf46f2f6aaa", "sighting--d4e8dcee-56e7-4500-a3b3-87f9e0068cfa", "sighting--bebe7f89-6962-4ce3-a0a6-296223651fff", "sighting--9b1192ab-b121-4c85-add4-4961c5417113", "sighting--4541d876-a2a0-4e4e-bc3f-dba98c9ef6bb", "sighting--0c66d203-0b74-4974-bc59-46b8b641e7e2", "sighting--773b4b2a-1abe-4d6f-aea9-99cff1246d2f", "sighting--fd90d7ad-fc14-4a06-b697-4986a7c280ba", "sighting--055be9df-c7be-4679-963c-c7a1858a9444", "sighting--c90ac27b-e05e-4196-b0b7-fd06777e0a4a", "sighting--f41beec9-e7a6-4a17-823c-71e7bf932b36", "sighting--f6c18dfa-03e5-4bb4-ba17-025750f97394", "sighting--90c61461-23dc-4a8f-8c1f-01a9f9427234", "sighting--fd31c469-b645-4a75-9155-3fa3f1c64af1", "sighting--557bf6ae-89e3-43ac-9b29-3d88e922bf27", "sighting--424758c2-1f6f-49ca-9915-29e46b6d5046", "sighting--b24bff4d-d3ee-4512-9da7-0d3111c8f4e1", "sighting--afe914e8-294e-40c3-8b9b-ea61715d6ad7", "sighting--9b3db5bb-04b9-43be-bfdb-9ec2ca0a92fe", "sighting--d35938ff-4ae8-4962-988c-b840f6417911", "sighting--53522218-9bad-4556-bbf9-b7af34eae7ba", "sighting--484d2aed-0c78-4d77-8649-be02b818c01b", "sighting--92a3ce59-fb93-47a6-affa-a045dd250b4d", "sighting--35d4cace-4a86-4d4a-9731-4dc1d6dd0206", "sighting--a1f4c814-f7f9-4e7b-a26f-6dbe99c70a02", "sighting--dceba659-0876-42e5-b48f-3fd018e3129e", "sighting--6774d024-b30c-4c43-a08b-be716c15a73f", "sighting--866a2074-36bf-4bdb-a483-7818778248f3", "sighting--9b6e7e8c-67bf-425c-8306-a34c03d9f3d8", "sighting--0b8309ad-5107-4175-bc40-90b53089abf4", "sighting--d10af1bd-cc30-4ad3-b9f6-805d6be77e40", "sighting--135e6c99-9494-4ce6-a00a-edc5c36fb516", "sighting--369be024-48e2-4dcb-9db0-2bf421da197f", "sighting--1e172e1a-8970-4f8e-8bd6-b56ae23492a6", "sighting--4faf92dc-430f-436c-ac74-c3ebd94edd5d", "sighting--5a5e337c-8dbe-4a17-8ef1-0085ff12518c", "sighting--877afc7b-cb99-44f3-8abb-c7687a45d425", "sighting--674b14bf-fe0c-42c7-b41a-65f217477d65", "sighting--375f57ae-18f6-4eeb-afb7-59a2da9ebd4e", "sighting--649237b1-ad9d-4252-b337-a91baba24a3a", "sighting--cec5150d-f1c2-48da-94e4-dbb8416c58b1", "sighting--b3d69820-614c-4651-b543-17a36f4e9669", "sighting--7699a2f9-9d61-49d0-ae28-924c09bdc058", "sighting--cf690b48-e741-47b7-a043-6f76f64adf18", "sighting--f3352f8e-2a04-4040-85af-c98dfc40982e", "sighting--814a3f53-0eb1-4c65-9501-ed96f29fb724", "sighting--b0672468-c2ad-405e-b4fc-2143842a9893", "sighting--227cb10b-4018-4efc-880b-044afdbff0cc", "sighting--ce4b0b16-423e-4b30-afdc-17d9deceee26", "sighting--8c848c9e-4798-4309-b2aa-b37d59056296", "sighting--59ae3fae-6946-4865-913c-f574bcd31548", "sighting--5f162d17-78ba-4280-b567-cdd6817ce991", "sighting--0a02bcb0-b615-4177-8e08-33dea923a8b4", "sighting--e4e8de73-e68a-40cc-8b3e-4f464a5b193f", "sighting--56b50751-4b61-461e-8dc6-384bcaed9117", "sighting--eeb56b93-b433-4561-8511-83a2bd0b181c", "sighting--5928083d-72ed-4513-ac2b-3b2449ca582c", "sighting--8629d718-157d-4a14-8f2e-715bd5f47a7e", "sighting--fec9beab-75f0-459f-83c1-0eb07405d9f5", "sighting--194f6495-d798-4b56-be9d-24b61c711c1b", "sighting--c2ff9a71-7535-4ec2-845d-2e8d6bb07941", "sighting--1201e05f-b260-484e-829f-c02613d1ff31", "sighting--0f429e3b-14d5-440c-ba7e-ecf574d47eaf", "sighting--e146c55d-0f66-4b38-b913-c56aaa1faed8", "sighting--4cd9ee14-8929-43e1-9611-0678706f99cd", "sighting--cea93edf-2678-46fd-b9d5-e223c7040e6b", "sighting--40a8fcc3-773c-4178-932c-99752e63141c", "sighting--8ba8568a-f2d0-423e-9621-5575929bbede", "sighting--c4443cce-f205-40cc-8603-966cf98409b9", "sighting--71a7cbf6-8312-49c8-a632-7de7f695a66c", "sighting--9f667825-9547-45c3-8cac-e0592d3f752d", "sighting--3a636b14-f83c-42ba-b652-080a037152a6", "sighting--385280f5-b21c-4160-b7c2-f26b065a8733", "sighting--a030a2cd-059e-4aac-b389-ee000b63eda5", "sighting--6ab1371b-ac02-4f1b-ae2f-14a4cf3a9354", "sighting--337864e9-f877-43b2-ab8d-022cfa749ee3", "sighting--f4f8ca05-c299-4ace-9bfa-399d24ee05ea", "sighting--290471ca-4612-4661-9af3-cfe85a0bf813", "sighting--70c91300-c682-444a-acdf-147a56fc4ce7", "sighting--46ee5bae-547e-481a-9b0d-4b7f0d3f87b6", "sighting--356363f4-f76b-43b6-86b8-da7089a0f282", "sighting--86255137-e143-44e5-a71f-e2eafe42d2d3", "sighting--84c34c70-69df-4c27-9c68-28cea36f50ad", "sighting--ac7cf5f9-bdb2-49a3-8c3e-1db43fe344cb", "sighting--487b4533-86af-4517-ae0d-0298f1817c5b", "sighting--c20da4da-5f06-40fb-8857-cb0f3b011833", "sighting--d13e2d1c-50db-4e4d-912b-cc3f5ce2439f", "sighting--28705d7b-8c44-40f6-8157-f3823bae8b47", "sighting--93a58f2c-9993-495b-bcde-4967597aa4a4", "sighting--962be888-e56d-437d-b5ad-46697b7d0c75", "sighting--9605ae75-526a-40d2-a628-98e48fb23fc7", "sighting--df833ed3-326e-45f8-8f74-364b84d0adbb", "sighting--6deba476-c6de-4694-814f-7fb60bfba0f7", "sighting--86155a49-b0a1-432c-8ba9-0bd700dbc819", "sighting--f131eb65-f1f5-472c-9e55-4644eab6183b", "sighting--09a76b6f-10db-4a79-a042-db72eedf84c9", "sighting--b9a3dd24-5baf-4562-8a06-5dcc9e548c09", "sighting--a5118b05-49e4-4a83-9160-5989023e4059", "sighting--2717a47e-0e8e-4cba-bea7-8e21842e79b9", "sighting--91f472b4-3d58-4da4-9264-7ea033f37076", "sighting--58bc7ef6-9624-4bd9-a8eb-6c2e9541fe19", "sighting--1e4e85e5-e1ad-4ae5-84e4-f558e9b2a2bf", "sighting--39cb2bfc-4711-457a-8ee9-dadf42cb800a", "sighting--63b94c99-8870-44d4-92f3-15d8e12bac39", "sighting--63d118c6-41bc-420e-91bf-c2d74a0461d0", "sighting--3733e7b0-689e-4f52-bb97-045eb784330d", "sighting--188a475c-184a-4029-a643-0043cd7dbcf4", "sighting--c3dd6cc1-3939-4314-bfcd-497bf10fa11d", "sighting--54dac66b-3e56-4b51-8cb3-8481e16a2e98", "sighting--013eb7c7-c6a9-4ca0-bfa7-b7e88b2aa725", "sighting--a2ea3124-80a2-4e83-87c1-214099894b5d", "sighting--518575cc-a96e-4acd-a1d3-2540abbd66be", "sighting--8d467618-2035-42ad-a99d-e3559b634532", "sighting--d6b3d1d2-11e1-4519-9b16-fd8f568417ac", "sighting--fff67912-9aff-4568-a2f3-6f1d08b35f49", "sighting--b2c9323e-fe6b-459b-8ab1-c3eb6d003b80", "sighting--5f969814-b529-4c5f-9470-f1c242289972", "sighting--42a5b250-19c1-461b-8662-2b6efbb7048e", "sighting--06aeeea1-e181-41c1-92b5-1ba09bc82709", "sighting--1aedd472-aded-42ea-95a5-b0535cc52045", "sighting--4d8d0317-6297-481d-a512-f07748f8ff4b", "sighting--246933f3-c527-4ef0-87c5-eea2427de305", "sighting--ab7e0a75-e341-4b05-9cc5-62be7f6b8a01", "sighting--d5b5eb93-7e58-43ea-b166-aee4ff2eef08", "sighting--a994fdc3-10ef-4a52-9933-99794e75f888", "sighting--e3666fb2-5ea6-4b8b-a7ef-445bafa4e6e0", "sighting--390f2433-bdb8-4659-b6bd-103fab1aa7d9", "sighting--72497e25-a721-40c7-8ce1-4f95dd6a35dc", "sighting--cc3ec917-c313-40f0-a80e-a2dc7fb33b0f", "sighting--6758ec3a-da97-43d5-8a97-908fe3590978", "sighting--ee6fd251-053a-46de-a49b-53d97ca4543c", "sighting--d9251218-12d9-4516-8df6-963573cc2d58", "sighting--678d726c-79b5-4119-86c1-52abfa6ed5c9", "sighting--d60b8813-25bf-4541-98db-329740de6e06", "sighting--80418e5a-4601-4985-b8a9-14997aaada30", "sighting--e16999cf-2df7-4422-985e-b6b7282e0bb3", "sighting--d841bc5d-dcc1-49e7-8175-f85152b2974a", "sighting--5b2e88d6-bf92-4657-9082-cdf8446a4e4c", "sighting--b12d9593-2941-42c2-bda1-14ed776fa5d4", "sighting--52e27fa1-c89f-4186-8a51-0a8e8d91a6d1", "sighting--3d605e07-7e42-4b87-8168-8e96a9689ecb", "sighting--ea3a89b9-eb67-4a16-91e6-74fa83e4689c", "sighting--aa50982a-4789-4960-89e1-e1c326eb4c69", "sighting--53a3914f-4441-4236-927d-9db708ee712f", "sighting--181e1fb5-2532-428c-b9c7-4521627f46c3", "sighting--f3168372-4260-485d-97ef-c4390182527d", "sighting--c060d35b-0ae8-48f7-aab4-95dda5888487", "sighting--1595fc8a-9a88-4bef-99f0-7826d1be00bf", "sighting--296c7cdf-c8d8-4d6e-8d40-92996a422cda", "sighting--016f8748-d023-4062-8c80-1cb85b86db5f", "sighting--56e7c966-e984-4123-ab9b-8fdcc5cf4d76", "sighting--4efd7f78-032f-468a-a5e5-61013c6753b9", "sighting--6c232221-4445-41a0-971f-ba005e6731fa", "sighting--36d758cc-f7fb-42d4-bd2e-dd59c4fbc51c", "sighting--fe734c80-86ae-42fe-a0c0-d6d1e863baf9", "sighting--273c3744-c0d5-40e0-88e5-6f7b27b047cd", "sighting--0c7b7581-ae23-4094-b4db-f128d77e840d", "sighting--59a95e64-5d49-4f53-9647-cad779d8f8d8", "sighting--79237d4f-fb60-47ab-9ca1-ba0f2fb1beb0", "sighting--91ce0ceb-12fe-441b-aa4f-80dcca6ffe6f", "sighting--b684aa90-3c55-43c6-a170-c04b2fa4a78d", "sighting--535cd57a-ffa5-4b97-9124-78ba9ed8cb9d", "sighting--f2f1a2d6-f432-4a30-a257-7ec686c71ba3", "sighting--9e8b8717-e854-4c99-8a95-083dd545be7c", "sighting--6fd12124-6873-4ecf-9e54-6783b0b92eb5", "sighting--d3be83d4-2fec-4f2d-b0e6-efa36d23ede2", "sighting--11611f2d-80f2-4829-bc01-ccf7b31bdbae", "sighting--aac7a5d4-cd57-480b-9f4d-1a200177e227", "sighting--b14d5bd7-5421-422b-85d4-b149494113de", "sighting--464d0efd-71db-40c4-ab29-254b7ccd2505", "sighting--c346b1df-51e2-423a-9729-1ab69c4b3a35", "sighting--46e5bc6b-119a-461c-91a6-a54742b487d2", "sighting--d1379cdb-c384-45b0-8122-0746d997166d", "sighting--8a09ec4d-a519-48ae-a84c-6c555afeeca4", "sighting--dccb2feb-7fe2-4dbe-90bc-bbe5595ecce0", "sighting--01c163ae-bbb7-4247-9ac9-a65f336250d7", "sighting--f9677624-4402-4958-8b17-e66dab8ecf27", "sighting--6257f107-faba-42e6-8e07-a68c39a6c507", "sighting--96133cda-fe13-4f62-9851-a8df1c5d4bb6", "sighting--cd63f748-d03d-4582-8f68-304e8ec9bd09", "sighting--46f501cb-4343-4d81-996b-c9896615d246", "sighting--d2303917-7a67-46e1-a489-c3311881d289", "sighting--ef98dfb1-eb93-415e-88b5-72b34ddba9d0", "sighting--c27d2dab-f8a5-481d-8e0f-a170325faba7", "sighting--8e0c747a-5e36-4d61-b8b3-dce8ca9bfc1a", "sighting--c67b41ef-ab48-498c-a785-60a9965f034f", "sighting--71c9bbea-f1cb-49b5-a4e8-878c661dd4c1", "sighting--4ecea4ef-c70d-4435-966e-d57f62ccdd1f", "sighting--d89ff054-17c1-40d7-ab7a-c0505ce582d9", "sighting--c873107b-1e85-41fc-8edb-f4afb8607b29", "sighting--e6b7108f-b6c5-4b2a-b2f3-3fa611f0c93b", "sighting--c879f11a-d80e-4ec3-82d7-c3f9625b84f5", "sighting--2de73452-2b66-483b-ac5e-ee62b44ca3df", "sighting--7b0792c7-bf1b-4eef-8e32-b7c8acbd78e6", "sighting--eac743d3-b787-49d4-8fa7-4cccb32f9bed", "sighting--59c23a11-fa7c-4ec7-acb1-f70a2e813ebb", "sighting--0d2c4c4e-39b4-4c24-8b55-f9b3de721f80", "sighting--32a94329-b05a-464c-aedb-a965e087e7a8", "sighting--421ae505-1e46-402e-8fe2-6b20d912246a", "sighting--6c336b2d-0a89-4c34-b8da-192cff51fd37", "sighting--ae577827-6158-4123-b5c7-fa76eed0358b", "sighting--eab8f3f6-484b-4bb3-8168-9b17eeeec646", "sighting--15ed642b-e75d-468d-84f7-2720d4df969f", "sighting--bf90422b-965c-4bfb-a068-c577467cf691", "sighting--e4932fbe-f954-450b-a89e-d0d96d4fbf98", "sighting--d8adbf24-afa6-4cca-bebc-f6db8da85120", "sighting--48aeb7e3-e5ea-4a1b-835d-dea58da945b8", "sighting--73a4513b-ce50-476a-a6ea-4838a680976e", "sighting--10b14f29-f32c-4076-90f0-368636233497", "sighting--89e37699-a24b-4a21-abf4-02930c08d881", "sighting--abaca15f-cc3f-4443-a2f0-843abf619c78", "sighting--ee01fab9-bea8-4d9d-9d7f-097c0f090f9f", "sighting--a4f5fc2d-beb6-4fec-ac68-b23156c09b46", "sighting--0120d9cd-e8a6-4b6a-991f-49816a2b99e5", "sighting--6808ae57-7776-4174-bb76-37e3ea675991", "sighting--eb2f4955-552c-490f-869c-949f53f5d4bb", "sighting--b91a3c0b-b9da-4d4f-b305-9600786ed678", "sighting--c22c7316-29a1-45b2-ab89-69384a2af6f1", "sighting--4ac160f7-ee03-48f2-b027-25916f6de807", "sighting--8b61e093-420e-4197-92be-8eca871528b0", "sighting--750a4ac0-a04e-4e59-a0d5-312ccdc10970", "sighting--5268171a-6396-4bc7-b180-83f1cab4a574", "sighting--e115588c-b74c-4501-98b5-70685f0a4a08", "sighting--bac14e6e-0916-4002-ae0c-8834b343dbc4", "sighting--51c08365-2c00-4ab6-b9a4-78f5c1d604a4", "sighting--a11bf91e-a4a8-44ea-9167-2a75369ec3f0", "sighting--a72ab573-70fe-4138-86d5-fcf308a14e09", "sighting--e598aee4-ba68-4f2f-8551-bfebddad0134", "sighting--21367b1a-7b78-4ca6-9430-423cc44823c1", "sighting--68dd4260-8408-4d49-8be3-28b62912c677", "sighting--9fac7719-3b74-4033-8509-d07b61f93ea8", "sighting--644ecfd5-bd1c-46a0-ad0e-0b65da66260d", "sighting--31ca022a-b48d-4541-a318-c90f2f9a9399", "sighting--9c9d7451-e714-472d-8d0d-8486d62a80ce", "sighting--fce3ed8b-6010-4faa-ab48-9a53a8213db7", "sighting--b97346e1-8cf1-42e5-b58a-87e35632166f", "sighting--11488a8e-405a-4d61-8223-977c37c3b026", "sighting--d67ada1c-91db-4074-b9f8-b94a43b23aab", "sighting--64d8a54f-e22f-41bc-af7b-f1ffb750b34d", "sighting--5a7b7f3f-b16b-4af2-bc48-8f91b42cf266", "sighting--7788108d-c127-468d-a050-5fe36afb6428", "sighting--3a989c6c-79f5-4928-8097-8ee449187386", "sighting--65071f26-70d4-4281-b5b1-87f44f8c06f4", "sighting--e90882a2-9670-4473-9767-208612c64f34", "sighting--576a1775-f876-40cd-9b3f-83a704ce1420", "sighting--6ffffcfc-960d-441a-acbb-7482b6eb46e2", "sighting--75354a35-cab4-4fa5-b56c-66c1c2e9e60e", "sighting--8228c2f7-547c-438c-93ab-de76602da150", "sighting--9dc09f02-7480-483c-966e-694b58da9e75", "sighting--b7df77d0-fa23-4809-aa59-3f4328f564f3", "sighting--aa9efc82-f1a9-44bd-af8d-e25023004b4e", "sighting--93a7362c-eba0-40a9-a2bd-e3138b3b6f3e", "sighting--c6eb9d71-f0f9-4312-9c6f-5ea07b15e344", "sighting--87f8e686-21bc-41a0-893f-e44a0553d30e", "sighting--3fd2802c-fa75-40fa-8f22-9acc4cbada51", "sighting--827dbe51-d651-4435-b0b9-9f96842ea9e1", "sighting--bf58a3ac-ad4c-4458-87a0-d609498ee1a9", "sighting--5a085dc6-a159-485b-9508-3696f277f0e2", "sighting--464e9f33-be2a-4b71-91af-541502db9475", "sighting--8fefd0cc-c36e-49ad-91be-8f111a4fd817", "sighting--3dacc3cd-315b-4276-86c6-7dc25bd379e9", "sighting--6d948d0f-1fee-44c4-95ca-9a49b0c2c963", "sighting--eae0cccc-d026-425e-9a15-23b36d7dc906", "sighting--a1021d0d-b194-44d8-a0bc-332109cbf6ff", "sighting--efb89c51-43fb-4404-9f96-bf8238e60d85", "sighting--cc220220-d767-4f78-8a46-2718a4193ff9", "sighting--a7123789-75b9-411b-941c-55b670663dcc", "sighting--e8d7837b-24cf-443b-bcea-cf509aa85666", "sighting--180f5edb-e1ec-492e-8678-3c1c924c498c", "sighting--e7b58d55-2d44-44e8-af86-3ae6c4a916aa", "sighting--454319b9-814a-4c8b-a12f-343e93bf0815", "sighting--d36f0aa9-e968-4f3c-9423-23e324ace660", "sighting--f546c883-e5b4-49b8-baaa-d577d2134823", "sighting--a683f659-b098-4da8-8086-56f14e12c767", "sighting--563e4b7b-9860-4711-ba0e-443e695f272c", "sighting--50066108-1700-4de7-8220-80706b1feade", "sighting--f243023a-df42-4db2-99ae-be882a8b400b", "sighting--a056b2a3-e1f9-4eeb-9f88-8921054f5729", "sighting--5d2761ab-b417-4b53-bb03-39854ecdcc13", "sighting--e98a88a8-0e51-4573-8eb3-c09f77495ed0", "sighting--4a4f3f4e-7911-41b2-962a-efbc643dcc0f", "sighting--aacd0a2b-1a5b-4174-a80c-b427576747a3", "sighting--da41fbe0-d1d6-45c9-b152-d4665a1341cc", "sighting--61c569a3-0d4a-4f4e-bf90-5edae5fc0d47", "sighting--15151efd-a5bb-4275-93cd-6cd18c19eea3", "sighting--fa315d05-d6ed-4628-b1ed-b8245072b062", "sighting--e0678dc8-5ce9-49ea-bf52-6275fb4fab8f", "sighting--9f46de4b-8f11-421d-a3ea-9b9e17af41b1", "sighting--19db2574-829a-45e6-bed1-64b827d92783", "sighting--32708163-bb76-4e68-9446-bc8f9defd459", "sighting--919d818c-d19e-4695-8064-6da9fb6597cf", "sighting--1bdd905d-5d40-4a00-a5a2-1c7199658680", "sighting--928807bb-b7ce-4fb6-969b-38f1f32023f6", "sighting--e227c4a9-48a2-4301-bba8-0e3f82e1d263", "sighting--1820fb90-6a84-4c04-8c23-65188f7508de", "sighting--5936260a-b48b-4218-814b-c4fd18429cfc", "sighting--c1c06ca6-d97e-4093-8e60-d04191d58b68", "sighting--60a38d56-e583-4afe-ac4a-bcceaf112900", "sighting--09a522dd-71a3-4908-9f0b-0d4b577939aa", "sighting--b418a5e5-50a1-4085-8b44-ef032cd47c36", "sighting--c1fdd0f9-ad91-4b35-a59c-b5f51579f54d", "sighting--1bea4bc6-5dc5-4ecb-9259-29f0019f9f06", "sighting--0e0f2931-f6e4-40b7-8ade-d14a5a7c3530", "sighting--e4c32318-2d54-4d78-b458-b68c0566889c", "sighting--002ce3cb-5745-4274-a555-4d569d18ab7e", "sighting--316bdfc8-d1e9-47ba-a384-5180220efd5e", "sighting--806c1b6a-1b71-473e-9270-f28ab2c18197", "sighting--33adf68d-e65c-4ec4-a4d7-f7d9f87c26b9", "sighting--54484add-71b1-485d-99ac-dd9c2d53ec95", "sighting--1458e8ea-ac03-4d10-bd6b-7fe2b4a8f7d7", "sighting--11b6f2ed-2e00-4b69-8197-648cb666b548", "sighting--58ef4dd4-8c1c-4d20-bc26-b9be3c57bc98", "sighting--e34600c4-7496-4721-9eb7-90b423c806bc", "sighting--2979a329-4777-4ff9-ab09-24c3a5ed5d88", "sighting--7064672e-0924-4bde-b151-4fb6ea14c12f", "sighting--2c47a4f2-5166-4787-9a2d-c1d866b72794", "sighting--0b388f59-9a60-4d47-8fa4-437e41d5ef7e", "sighting--dfc7d4b8-7688-491b-8d45-3a5348cf65d0", "sighting--5e7791f9-df4d-4197-b31d-49acea0390b9", "sighting--694e1e53-0ddc-49e4-b183-c177f0d54622", "sighting--c6fe7039-316f-4a13-b340-e6700e4c3526", "sighting--c3e746d3-d61e-4998-a814-cb8c5a5f59cc", "sighting--d3bfa145-044d-4982-b364-5744d131c751", "sighting--e03960d6-93b9-46b5-a708-737ae7547e19", "sighting--df4a00b5-e5ff-496d-ae21-b2fc7f3d6e6f", "sighting--31e7d74a-f5cc-4828-9223-dc6cdca0578c", "sighting--2933b212-6f05-42ac-aeae-07268a75c8d8", "sighting--838373f0-ecd1-49f7-843d-1c9b38d3c5c0", "sighting--8b291036-2066-4bce-89a1-d27ec6b86a00", "sighting--fcfade85-3314-4362-a7e5-00ec7ff4b068", "sighting--70117dd5-5b34-4c46-a1f7-b5649f5c6508", "sighting--ecef8b88-908b-4448-ab96-c7f229552bc7", "sighting--29b8c0a5-0cea-45e4-8a18-d0e365b9fbd0", "sighting--5ae7f7bb-8891-4358-bff0-eca885a0628d", "sighting--24304b2c-d9de-44ac-b4dc-9650d69ed4cc", "sighting--95b7087c-ab58-4ef5-b25d-76de9ae17634", "sighting--872cc1d5-84d8-4fd6-863e-d6022914a1c4", "sighting--a2066721-9766-43ee-8ab9-3bd5c35af6fb", "sighting--2a424f40-3639-4a03-a6a6-50c648156a42", "sighting--e70f29ca-c7cd-40cb-bea7-e1b9a753c602", "sighting--43f1334f-c1b9-43e5-a06b-d9e1590ece34", "sighting--9159e4e0-87f7-435c-b63d-998588e1ec3f", "sighting--b52a1431-9960-44fe-b613-f1750612b91c", "sighting--03c75b78-1e57-4bc5-a98c-6523a9bc1e4d", "sighting--f26e43e8-7d27-41cf-83c0-35871f087a6c", "sighting--f2c7aa30-2210-4386-86ee-d1b1d790ab8b", "sighting--806da9fe-ea7d-4d14-90b2-191faf3ec4c3", "sighting--c26f2cc7-7ad1-4769-858b-db4a2456f593", "sighting--c530b79a-f5d2-4305-92eb-4a4d9228171b", "sighting--6be00af6-3569-4730-908c-ef40a4f13c14", "sighting--d648700c-987f-4eff-bdcf-6f22e63fbc11", "sighting--d50cd387-f5c4-4dea-b1bb-a59cfdb28b5d", "sighting--d906212d-4036-4b9c-b2fd-d0613c84332c", "sighting--29f4bb04-f547-4e31-8667-175d6c5cd63c", "sighting--cbff627f-2a84-4136-a720-a617db862ca3", "sighting--38a28374-03ce-4c1b-979c-c2fe80a459d2", "sighting--d155223b-ac7d-4dc2-a167-19dd1b1c1118", "sighting--71e828d1-a7a3-4594-b32c-96e9cb487c8c", "sighting--d6315f67-75ef-465d-9f58-ddbe41fb6699", "sighting--f71d807b-a96b-4af0-98e7-a792416a2a23", "sighting--f33a053f-427b-41cb-b5ae-264c1d458c3e", "sighting--bfee932d-1d2c-4d40-ac8c-c9fcffe56f16", "sighting--b8cfaf15-dfe9-4540-9b79-6017c81c4b44", "sighting--bd8ff7c7-1d85-4a38-b6fe-33f98f6fead9", "sighting--e7a74db0-cde7-43bd-b1bb-1f34acd2e700", "sighting--34a545a9-13cc-4d9f-bb8e-60e79c9ce317", "sighting--ef48b280-247f-4e90-a9a9-5ccc8e5f2608", "sighting--955d5b00-a081-4634-8347-a19c7129b4ef", "sighting--c3d9faa0-46a5-4c74-9ed6-2d0cc985b16e", "sighting--9d4d00f2-5e6d-4bd0-9b32-b066b983218b", "sighting--faf6b4b9-a7e5-4010-9bcd-6d2a1096b21e", "sighting--8dfecc6c-1264-42b2-ae93-91df5c83c348", "sighting--53916eab-67b6-4cd0-96cc-69bd0b9d2811", "sighting--a9c65ef2-dcab-4855-9045-64ac216aba8c", "sighting--5bbf5d0a-6be5-4cc1-9601-b4eadf88c704", "sighting--85b393c2-f4ff-41bd-a336-914c0cc35711", "sighting--4e0a61fd-3c6d-40a7-bc6f-1324afe979be", "sighting--8363aeb9-b144-4d07-8cf0-612468f66c1e", "sighting--718d9b33-d9ad-4ee1-a559-e4841eb2aafb", "sighting--b838825d-4d5a-4e2c-b92d-b15577f1ce69", "sighting--c5871fb9-a674-4690-ae91-277cedf8b612", "sighting--5c8ffd13-e7a6-4804-b492-7f499bfb0822", "sighting--25b5002c-cf50-494e-994a-95a45ccacced", "sighting--40e6616f-d45c-446f-bc41-61bb1a9ef8ce", "sighting--e6810739-28b1-4e13-922c-42904a0cc84e", "sighting--bf706848-0d75-45b7-b8ca-94f4a0c94552", "sighting--c76d09ce-eed3-4981-a6e0-124639c7d6c0", "sighting--f923549a-2f2c-48c0-a0e4-8e86c1280ad9", "sighting--e66aba77-0044-4994-9629-4047b7f9ae52", "sighting--94865239-d864-44ce-a642-d2c7cd731c40", "sighting--60405467-a0f9-4ace-a809-3e42266543f9", "sighting--a617c758-e08f-458e-ad73-b596dcf61e67", "sighting--39c38276-4f19-4389-ba26-083ff9b76e80", "sighting--22f8712c-ee71-4359-9b19-1324de8d44e8", "sighting--e0bfc387-b84f-46f7-becb-6d5c54c764ae", "sighting--ed717189-9359-4515-b713-83d831538199", "sighting--244a6bf2-3cd6-4c85-ba27-0260e42c2f70", "sighting--731b04d2-c231-4e25-9f76-87c7d548ba8b", "sighting--b62e1fa8-4333-4c92-98f0-c053a568c6bc", "sighting--e885b8ff-fff7-4983-8d3f-205208e72f4b", "sighting--cdcf6ff1-e2a0-490e-a5c7-c871aa2d330e", "sighting--a87c3df6-8950-4933-9827-9b1482e5e68a", "sighting--4fcfac89-c8c1-4598-a59d-91494c21a0de", "sighting--77538aa7-1d18-4a68-8c1d-1beda86ca34b", "sighting--0debe42f-9a94-4ac3-ad7a-38cb75b66636", "sighting--47db0c39-ecfd-4c9a-9954-983e84afa512", "sighting--02b64367-a9c1-4122-8a25-7e96ad5a8dab", "sighting--129298fa-188d-4790-88ee-d97099c35c4e", "sighting--5eef6cbb-8193-4ca1-b879-ad706b23cd71", "sighting--78e5cc30-fd36-47b1-8637-cee71078a285", "sighting--175f9145-7cd2-4802-a357-d0d4543eefd6", "sighting--ec7d9c78-7e1d-4e1f-a8ac-146ebf4a4f75", "sighting--bdb394c3-55b4-422a-a772-d5be0a2ef06f", "sighting--76788464-55e2-4845-bba1-a20ebcb42cf9", "sighting--2b1c8761-1515-4783-bffe-01124cc6960c", "sighting--f166aab0-bb4e-495c-9096-c0c0869ba371", "sighting--2fdd9013-bd97-4674-9ea4-ab8ddc8c1700", "sighting--7dc8f9f4-c48f-4767-a397-c21a2109312c", "sighting--351f4fb0-8e83-4a80-8ef6-643c203407b7", "sighting--dc9abcd6-b26d-4c03-b26a-bcc1a681f287", "sighting--005e7733-8ace-460b-a3d5-1373634c6d3f", "sighting--95621c87-8d73-4d53-97a0-00f5daffdd1c", "sighting--1766ee89-d3d1-49bd-ab8f-a63955cc9986", "sighting--211ba1f2-214b-4198-8a3c-d116d1fa47bf", "sighting--63ba01bd-47f5-4db8-b1c2-81b4451c368f", "sighting--87762da4-9b25-41c4-8e37-5bfd4e462c69", "sighting--01b7ff81-4bb0-4933-8887-df71eda622a3", "sighting--410ae20a-4533-45fe-8f4e-47cdd9be8075", "sighting--75de90dc-fbaa-4628-b736-fd1d06581d7e", "sighting--93519977-8a1a-4326-ae4a-bcfa01ae5e68", "sighting--ba1e41b9-d4b0-4447-b176-00fd92d287dd", "sighting--4f3764bb-3d92-4e4e-8219-695df1057f31", "sighting--65e635ab-993b-4382-97c7-8e3ac06bb56e", "sighting--da4f707b-f086-4ed1-b59a-0374ce3101ca", "sighting--cecc57c6-a607-4328-8bba-1fb146e09605", "sighting--f9ca0bb8-f740-4cf1-a2e4-49f4820bd2bc", "sighting--3b164eed-ef20-4216-9c3e-00100663e942", "sighting--afe076be-54cf-4666-acb6-9f02a6df627b", "sighting--b27e8e66-a9c0-433c-935f-f2d341e403b9", "sighting--59aaf220-0261-4b4f-ac93-e62aa24260bd", "sighting--bec803a1-35d9-4f0a-bcfb-c513ce3c0fec", "sighting--0fc7b7d8-f3ab-4ce5-86b7-ca3f36ee4cfd", "sighting--70c3ff82-01b5-45fe-b0cd-005855e01c2f", "sighting--7bff4496-20c4-42c7-85cc-7aab504e5bf6", "sighting--4b3b7211-e277-457e-9a9b-9205ac2252fd", "sighting--e28fc882-7e7b-4485-b3c7-2e214edf1a8f", "sighting--02321188-a436-4b05-88d5-3d9ee2651dc4", "sighting--2134b94d-6539-4914-aef1-14072f1f9b16", "sighting--ffcd7920-9d74-4881-bd26-ce6d32d82a01", "sighting--506f81b1-8a89-4cb8-964a-5929041c4a14", "sighting--bba5fca5-3a03-411f-be00-652d971b6ef2", "sighting--497e3cde-6083-4815-b8f2-65dc27c78a9b", "sighting--c263dd5f-b068-4bb1-b1fb-b65743f6932c", "sighting--064e165d-0971-4f04-be5e-712b69ca7e4c", "sighting--56bacd80-9bfa-4043-b92b-500dbb5e9acc", "sighting--54612986-52b8-4432-9786-dc35042b35ec", "sighting--42fa5c90-009a-4356-beea-ec371d013e8a", "sighting--3843a99d-05a8-467f-a8b2-e2594d30e1fa", "sighting--f1b1d136-e721-4de8-be0b-744e073cfb54", "sighting--b792599d-036d-4246-9e01-2f5789d1eb4e", "sighting--0f59b7f1-b7ed-41c9-9116-7c466a35f0ab", "sighting--ef7f9975-728f-4e46-9815-dd2a4beb8996", "sighting--1240fd18-d9e2-4f21-b1f0-178743d6e999", "sighting--d34ae61a-fcf7-467b-b8a4-45621df4a9dc", "sighting--70332228-537a-4c0b-b7ca-50441e510317", "sighting--4166557b-da5d-4447-a6da-0eb92ce8c31c", "sighting--3f90141d-0cf4-4119-9e0f-c5187f161c1d", "sighting--d215971f-accb-45d9-9c35-1138e96aced1", "sighting--4ed07789-f625-48a8-8a77-35bcf80911e2", "sighting--f393bb1d-a321-43d5-aa70-7151a10dccb0", "sighting--b677811a-9712-4a59-b917-99ab72b929d6", "sighting--56913a42-bdf1-40b1-99a1-7c15a5da0aa8", "sighting--b893c6a5-852f-4c39-b2c2-a1ad72fe164f", "sighting--2705f10d-1bf7-4814-bb6f-f3a1981e8076", "sighting--46b81229-8acf-47ea-8455-9b9ee8dbc990", "sighting--ecb7f4b1-420b-46f7-aa09-edf4ee59eb17", "sighting--7aaaac12-de1f-4681-a9c1-19240cc27e0d", "sighting--20232728-c97c-4d9b-b8e3-80ee01de09e9", "sighting--de001683-522a-4d69-a951-2470ac6d3186", "sighting--aac4dc5e-e906-45f5-9893-bb9ca5e8842f", "sighting--19376ed2-1fae-43db-9648-9dc65b0ab24c", "sighting--26897515-f19e-44c3-b134-973476aeb46c", "sighting--30ac76a0-3032-4efa-bc56-51249b82c250", "sighting--39be3e5c-179c-4b1b-8bdb-c8273a54b732", "sighting--42b8c580-0991-4f4d-9d89-2335818e32e5", "sighting--ee3423a3-76ca-44ca-83c0-e1f061b8c7b6", "sighting--6558d40f-fd82-4569-926f-1bae5c288fbb", "sighting--a7ceb123-95cb-40bf-9aec-b9f28dc47e28", "sighting--cee35f02-f7da-436d-87ee-9867dfb70dde", "sighting--64542338-31f5-440b-91a7-f25af158ae9a", "sighting--0aa35a55-5376-44d8-8654-ab3cdd7d1aba", "sighting--234bc202-8770-4a51-9fd8-a2f58bec2728", "sighting--99d21f5b-2b7b-4d7f-92bb-271b9da31fe2", "sighting--4bf625a5-0d31-4d8c-b34c-6eb1d43c3bb4", "sighting--b990b865-5d55-4537-8a26-3ad9313c915d", "sighting--addbae40-a432-4ab0-823a-eedc35d8ea1c", "sighting--1fbbb0d1-31d8-42b9-aa48-c7eb934ff767", "sighting--d4480b7c-6d12-427d-8c43-3265a1232e98", "sighting--1ee41f57-920b-4961-a652-521ee32d09e2", "sighting--17680de4-a02a-47c1-b663-d0880cbee49a", "sighting--0f2aec8b-2423-4642-9241-d50162841e7b", "sighting--ca0b0bf6-5803-412b-b9ce-9b0939d954ad", "sighting--24a0c910-d4f2-4b8c-91a9-3e7de0e8cf06", "sighting--b543b493-b08f-4856-9310-db98d735ca3f", "sighting--62f69561-21aa-40c8-af0a-4fd29c3a154d", "sighting--246c0899-ecce-47b4-ae57-31b0bcd0c9f6", "sighting--8cc00b6c-839b-49db-8c2b-6833321fd79e", "sighting--161f9ca6-6b33-44b9-ac3f-df2992809c55", "sighting--09fade93-9a49-4210-8527-7b5a367366a4", "sighting--e80bdd1a-36f5-4a46-aafc-54c434074d2d", "sighting--d1804ef7-7732-4905-b8b3-d8924a8df722", "sighting--5dd02b99-1946-4af3-85b0-2b87bd9f5061", "sighting--d6a0460c-8dfa-4492-8315-95d964c7e9a5", "sighting--390e7aea-2553-4e06-9fb1-a14bd5e9d689", "sighting--b52a7d7b-213d-4617-8c5e-a065b8ed6423", "sighting--078ada26-2110-4e75-83d0-2108a1645ac7", "sighting--17dd138f-59f4-4dc5-9c0f-3cfa3f82d532", "sighting--c65545d3-d332-4176-ad1a-2214acc970c7", "sighting--471873c7-f2db-47d2-9c26-236fb80e7fd5", "sighting--5cceacd3-6921-48e1-a38f-ba21833e43ed", "sighting--b2c36b84-2c6a-4ba6-a581-c7963921d049", "sighting--826b4b04-293f-41d5-8d4d-db4aa3c9c8ba", "sighting--5ae9eb0b-055b-4c8b-8357-6f07c2ee413c", "sighting--d6713ee4-6485-4bbb-bfeb-68a434bfd995", "sighting--11b447df-210a-4489-a144-f4270e330205", "sighting--86d89906-ad73-44c7-90de-158a74cb61f6", "sighting--456f9bce-ea31-4617-92b5-df2150bb0df8", "sighting--c65e3aed-03c4-4a0f-a5f3-fdfcb3b4971f", "sighting--8ec758b1-fb5d-4b53-aa6c-2dbe91888d0d", "sighting--93280cb6-c246-467b-b4f4-712e4ee34421", "sighting--87883f37-6f59-40d2-94f1-f95e950948ef", "sighting--6af2f416-c452-4568-bf99-b147be791deb", "sighting--6b580784-a825-49a0-9cb0-23478e9961df", "sighting--7a6db086-528c-4ca0-98d7-0dc83df1d497", "sighting--aafacaf6-7147-458e-978c-07cd7f67497d", "sighting--8766fc9d-f012-4a29-9859-7c45b79ee9aa", "sighting--00a41c75-4de9-420a-9d78-a84257e5cbc2", "sighting--b50500b7-3214-4684-9ce5-197820f5a0b6", "sighting--d1a654ef-88f2-4ee0-83b0-60b554fed69d", "sighting--5d54b0d9-48e1-456e-9211-ffa9092a42c5", "sighting--e18be21f-fae8-4d40-b2bd-831321ba5e39", "sighting--b305ae6c-d934-4754-a7ef-ae240d8b4bc4", "sighting--40e52324-2770-49c0-9e0b-d9bf8014df15", "sighting--2475849a-4d02-41f8-b6c7-0f533598e8fc", "sighting--d094b883-eede-49ab-85d3-6937effd5a92", "sighting--10ad9102-59ee-48cf-85a9-3e883ba2cfcb", "sighting--e413659c-73fa-4e2f-87ad-01f362f2e5ab", "sighting--ddf13276-57cd-488b-b6d0-7eed9ab20735", "sighting--19b9f8f6-97fc-4bd2-932e-c0852f3ce7c0", "sighting--68b034eb-143c-43f4-bc26-c2e05562f763", "sighting--581d9908-f012-4218-a807-0c4a99b3808f", "sighting--61097e81-2d60-4940-8ca3-b654c2ef244a", "sighting--988e4b06-ca03-481b-bc72-f99f25f4a861", "sighting--558457c9-9020-40ca-a9b5-834b9eb10c41", "sighting--6dbd678e-21ca-4dcd-9097-54385dafa3f9", "sighting--daf912fc-a1e9-4458-859e-2b8fc42f4db7", "sighting--bfb99f4b-e424-43fc-9600-d35e75271578", "sighting--37c08db9-85dc-470e-be6b-65051d20cee3", "sighting--69f7a351-2db0-45d1-9770-c2f6fdbeada3", "sighting--4a92bb4f-dec1-4aab-85bb-8ac61a49f083", "sighting--a393bd07-f025-40d0-a14d-441b775e87dd", "sighting--90dcf280-28ca-4b55-83d0-727ece0d51b9", "sighting--df5eed49-be86-4fbc-a67d-c0127bc05293", "sighting--d466ff23-b3fe-4538-9694-2a0b768eeca6", "sighting--e6879a87-02fa-4ac3-8fe7-c1e8ed9bc8ff", "sighting--c758952e-e7f7-4e0f-b3b9-bfc6af0da4ef", "sighting--1a395543-2ca4-40e2-8271-5db1350655a3", "sighting--48aa809c-d1d5-4697-8723-94dad67689f9", "sighting--8f583976-6eae-416d-8304-fbcd1e65d78a", "sighting--f49af3f9-9d53-4aa0-97b5-ee883a281748", "sighting--e067fbbc-eab1-47a6-baba-9ceac97c1633", "sighting--730a64b6-a312-4303-88ce-1beb876be90e", "sighting--4c8a8d9d-fb4d-4da6-8748-20f4ad852922", "sighting--d56dc0e5-ddd4-4247-bebb-a616315fa33c", "sighting--105b2219-c974-4f07-afc8-571bc868a312", "sighting--d6859612-f4b5-407e-b740-e9eb40179f36", "sighting--96ab10d7-cf38-46b7-883e-ae51e5083f83", "sighting--2eb6fcf0-41a1-4852-b8de-9859ebd683f3", "sighting--1db93086-960e-439c-972d-33b9e73d86b9", "sighting--28ab8afb-ba80-493b-a6b7-9fc1035828f2", "sighting--84f45ad3-fc09-4094-a0bd-942875519f2e", "sighting--74641d28-b330-4c9e-81b5-48f907023999", "sighting--5228f223-675b-4c42-9577-570a29c719f5", "sighting--158f0e97-6a64-43e5-a706-15efa455d1ff", "sighting--0fd8603c-de02-4157-b2d7-68c74a845c52", "sighting--976e316a-1c3a-436e-ae82-0760710a23de", "sighting--df690c01-38c7-45ef-ae79-69221b747a23", "sighting--51b39ff8-0dc6-4507-be3f-0a90239f1964", "sighting--44873de7-5854-45a1-9552-4ef46d568881", "sighting--64f445fb-12c7-4761-922a-6692a3d6d1c4", "sighting--1d04d7da-034e-4589-ae74-c88320c2df79", "sighting--fc4de83b-fc07-4a9e-8e7a-aafe517025a6", "sighting--81984387-2a30-41a4-99cb-2fe06392774f", "sighting--7e78bb9f-0d94-4355-bab0-a96265dfef26", "sighting--03615b1a-ca07-4bdc-8357-813b03e020ad", "sighting--ce4c9446-a699-42d1-9582-d3b96e0d119a", "sighting--f6031583-00ae-40d3-8375-5a40a8d19c1e", "sighting--f370915b-96ad-4878-9fc7-baa1ca604aae", "sighting--59267838-6f66-472a-9244-c9a60300d71f", "sighting--28129a3a-7659-4290-8fa8-fbe130a8d5b2", "sighting--41ad5be5-a647-4a64-bcd6-3ba506f36fc9", "sighting--95dd1717-b346-4aac-a4c2-d5d2c2ac196e", "sighting--0d6920b5-d1af-4ee5-a93b-5b6c51d7eca2", "sighting--63150e4e-2620-4dcc-b16a-811bd2a7e833", "sighting--26ded0f0-7e41-4bd7-8cd6-71b4e1c255ce", "sighting--34125527-1c29-4b54-9c20-023b085262cc", "sighting--edc2120e-1242-40b6-9f2d-050ec8ccf5d4", "sighting--279e8887-2a26-49a8-b4fc-b70c021f9736", "sighting--2273c1ca-13d2-48fc-bead-8527417e833e", "sighting--fd0476ca-76d4-4aaa-b140-5e6b25952743", "sighting--0a9a876c-0f33-4f49-aa50-d390fa6b3e2a", "sighting--a27a89c4-b650-4a57-8724-dfa880f8a886", "sighting--7a3e67c6-bad4-4f34-81eb-5130b7ef4bf0", "sighting--f16aad00-a32d-4f0f-bd35-27895c0dc595", "sighting--056fdfed-b1b1-48ee-bba2-9205ffdc5cc7", "sighting--07baccc8-2a52-4645-848e-d0b02b86b053", "sighting--f8068775-6743-40ed-bbf2-b0e50873857a", "sighting--c018e66f-4467-4b73-b1fb-3c0105cd18ac", "sighting--da251775-72ec-4350-9c2a-bafae786ecc7", "sighting--9d2db012-bbe5-4ffe-aef8-2d1b21031f3f", "sighting--160722fa-5a84-4e00-9da3-7071f7d1b76b", "sighting--c859b74e-e625-4b71-9499-1ebea1eca680", "sighting--1cc0bfdb-acc0-49c9-98ba-6eebd8376422", "sighting--2a8af9b5-6ace-4402-b336-bd13a3b3815d", "sighting--839c3d09-040c-4fd2-ae6e-578f0b43b517", "sighting--77b686b0-0881-4e16-bdf6-0a88eb6700e4", "sighting--85ee2f2a-ec67-4191-a4b8-a02252dd7e9d", "sighting--3e60c56a-cf5f-49bc-a8e6-368eea83545f", "sighting--ded699f0-fb63-4562-bbad-9664ba6a913c", "sighting--1850a687-cb69-43a5-bda6-376ca85d10b6", "sighting--5c731209-2f8d-41a4-9d6c-d8e44c847d5f", "sighting--84bbff3f-878d-4809-8151-44c649592b6c", "sighting--c59350f3-a111-4a0a-9753-4b69bad08b1f", "sighting--b6b89ea6-ea27-48e1-9551-6a8019d6ed93", "sighting--be3e18a5-09bc-4fc6-8edc-c2ec4397f341", "sighting--45cd06ce-3101-42e4-bc3d-c611e6d2469a", "sighting--e793f758-0997-440f-ba7a-1c64db54e336", "sighting--2a890aed-9cfc-4701-b4c7-5c57fd079edb", "sighting--fa25adc7-af6d-4d80-b4e2-eca1d5fb88e5", "sighting--bd946237-58f0-46fe-97c6-245885930128", "sighting--c8312adf-2abc-45ca-bf48-3ba942f49a2c", "sighting--e9bcf1e3-7ca7-4ab5-b403-ba61583024c1", "sighting--0f8249cf-27a0-4a1b-9e56-f87be91ad6e3", "sighting--b446babd-fea3-440b-9ac7-78d2b404a430", "sighting--b9cb63f7-daed-4029-b327-7b12b91a532a", "sighting--669e12bb-cab4-4c4d-a74e-3790b86dc648", "sighting--f9b347d6-ee02-47e1-9f4e-f80e8b687c92", "sighting--27d8e207-9bb9-41ee-9228-c6ed632b3019", "sighting--5d9ad51d-cb8f-4861-be7b-edc13b9f7a12", "sighting--a3593a77-8edb-46bc-b4ec-88f3c2b1b6d7", "sighting--c95bfa3a-1e5d-4a7e-b248-5c6efca6aec0", "sighting--c2bf749f-ad87-4f4e-bda2-cab5e386f261", "sighting--8c675e39-d58c-4b04-ae61-6cc712b85533", "sighting--4d691258-9933-414e-8f80-d914369c008f", "sighting--043c74bf-f327-4f84-9f9e-0c79738dcbef", "sighting--bcbeee74-2ba9-4108-b341-450a43d5fd3f", "sighting--7debaa41-4485-4730-83a8-9b715a30c1b2", "sighting--885af5e5-7c38-4d9b-b3b9-4e1c9856040d", "sighting--aa829479-d432-4c4c-9cc9-bfadff25ab39", "sighting--a7fec8be-c1e0-415a-be74-6401f5c0fc82", "sighting--bd911013-57ed-493a-add1-7e35e9ec48e9", "sighting--d3e3faa7-2d29-4cfb-b098-ba5f934bad63", "sighting--aa9a8159-6420-4407-9406-8284fb0a48be", "sighting--4b0eae04-a4bc-4ff2-b355-154c4adbde6d", "sighting--2868e1b3-463e-4d73-a3b3-bbeb2b8e7e36", "sighting--e981e190-022b-4a67-ac21-045b1a1b9451", "sighting--f83052ba-b4ee-456b-82e1-78459497bbfc", "sighting--4149d329-a709-48be-a0b1-71825d79a575", "sighting--1f217de3-e817-45e9-b7de-98e84ed0f358", "sighting--7241c03c-765f-4e94-9636-e9724fc3f4ad", "sighting--1aa26ead-be7a-4c25-8b17-8c6e6106d2b0", "sighting--ad44e586-a823-4c98-a5b7-d609de3cf654", "sighting--9103e310-14e7-4cac-8798-ea8bf39f9a6f", "sighting--70c89f05-56ba-4fc2-8555-63bb5a099dbb", "sighting--6edb319f-7c4b-4151-ba5f-9f0e78e54972", "sighting--b1edafc5-c9fb-493e-ac13-6226d5214d50", "sighting--4059cdde-f30d-4810-a5ea-cd682ce542db", "sighting--5f864f76-35f0-4435-9761-4043e9c14f87", "sighting--00eb3d07-1a66-47d5-95d2-23cc76b08e8a", "sighting--527305df-f55f-4442-9bdf-18ed4564a9a6", "sighting--92b145af-17c7-4200-b137-ba144d0e9d61", "sighting--e1b67f83-87b8-48f0-bdc3-320f2a705436", "sighting--67545975-0eb9-4600-a722-a38233a2ead4", "sighting--cbe37adc-4281-4e06-8dd4-b6208e6ce548", "sighting--4ed5623e-b2c3-4ca7-93a4-cdcf4a659b58", "sighting--8e2093e4-92f7-499c-9ee0-2be5fcb0be7d", "sighting--abb1ea1b-ca9f-4308-b457-9b3396fcc583", "sighting--3f799734-d52a-48fe-a24b-0e5a8ef1cac0", "sighting--5563dc24-ea6c-49a9-bd1b-6148aa348d98", "sighting--7ed25448-e631-4cba-9210-aead2f067a21", "sighting--9f648cd9-840a-4f62-89c8-280351f94dba", "sighting--35262ef6-8eed-4198-9fc4-92a90e91ddb8", "sighting--f0ce8fbc-2f70-48d1-b0fe-8c8fdf1b46ce", "sighting--f8da627a-5a50-4103-bbb7-116f97916da0", "sighting--54777432-6faf-425b-9090-36eec49f0896", "sighting--a7c00f2d-b2e1-41a7-ac62-9571a6b2cbd6", "sighting--a05ffd9a-59f3-4a36-ac0e-0c0cadb92887", "sighting--4b78282b-78fe-44f2-aa74-e2215dd3759f", "sighting--4a7f41ac-185a-478b-ae01-8ec7c9f952c0", "sighting--9284b1d2-548c-4634-afd4-29a36d4d467b", "sighting--96bb28d7-ba8c-45db-860a-9e67932b6584", "sighting--555d38ea-2614-44c2-ba95-38fe1aad2312", "sighting--76174382-9a92-4f05-9f77-db349f9b4b1e", "sighting--cda2060d-6289-4009-bf8c-db06023ba77b", "sighting--2e4b787b-f5b4-49f3-b35a-5fbc94223671", "sighting--652d7a69-c0a8-4b34-be0b-f39a17c0f6a7", "sighting--c5a3784c-07b5-4c4e-99ca-88a4997813ef", "sighting--cbba0fb1-fd78-4a2a-ada7-98be0a3bed21", "sighting--ebcb0c0d-c305-49d4-a824-c3685a693bd2", "sighting--fad61be7-90bd-4b36-bfb4-b1f06789d9ed", "sighting--40a5e079-6ed2-4eb4-9654-14bdb2663789", "sighting--e55e9239-1c4c-4b8c-b414-e7f96187c9e3", "sighting--933f3156-8b50-4908-8b37-6602e250fb4d", "sighting--61ff3a58-9a9e-4fe3-a1e7-32fd17371411", "sighting--3ea974cc-c73b-408b-8458-ad1debe3cf67", "sighting--6ac5cbf7-b8f1-41fd-b728-f208b6e8c230", "sighting--f58cc416-9162-47f6-a0dd-469aa7f64456", "sighting--5c5a7231-c7ba-4e10-87f0-12279aa5049b", "sighting--466ed80d-80b9-4209-a9e5-c1c719069e8e", "sighting--998d59a9-0a3a-438e-9cb7-ea0a83c0a1b4", "sighting--9cb864e0-79a7-4334-800c-e7d6badfd64b", "sighting--06d4d053-eff9-4e33-8d05-0855b77ede33", "sighting--de2c01e0-602d-421d-8cf0-b8b2a85babdc", "sighting--f224a031-077a-4772-94a2-5be22fc77ec2", "sighting--b108908a-e0b7-41c5-b1e2-8e25a4467208", "sighting--9cdcf0c8-8301-4d79-84fd-30ae7a3bdd1d", "sighting--6df2d62c-84da-4cf2-87a3-fb4afcc08b6b", "sighting--d466fcdc-52ac-4179-b66f-a7c7a8be9556", "sighting--96c0c773-d58b-4437-8d47-63b63a353d85", "sighting--f03a0323-e53e-4485-be6c-0ec1e9191d8c", "sighting--b9d77fdc-c626-47a4-a7c7-22c466fed08f"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-08-15T11:00:02.007Z", "modified": "2026-08-15T11:00:02.007Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}