{"type": "bundle", "id": "bundle--02f6ef57-1653-4082-83a9-f9e5b3270cc9", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e", "name": "Reverse Proxy (Perth)", "latitude": -31.9505, "longitude": 115.8605, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--307462f3-345f-4d9c-868a-17a19e3a1c37", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--a16d8aa9-c90d-470f-b91f-2daac2d6860e", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--4d022866-542e-4224-b2d3-c8acd9fe47d8", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--d12936b1-3a00-4dc4-8325-468255dc7393", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--d96177ed-b5ab-455b-bfc7-c255e4b9d066", "name": "Reverse Proxy (Perth)", "infrastructure_types": ["firewall"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fc991538-7441-46ac-874b-f1a2526c2a64", "relationship_type": "located-at", "source_ref": "infrastructure--d96177ed-b5ab-455b-bfc7-c255e4b9d066", "target_ref": "location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--24b87423-83ce-4b54-98f4-1b5946f9f772", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2cf4a4cc-a9c8-4215-8459-ee59a85f067f", "relationship_type": "located-at", "source_ref": "infrastructure--24b87423-83ce-4b54-98f4-1b5946f9f772", "target_ref": "location--307462f3-345f-4d9c-868a-17a19e3a1c37", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--921e80b9-b599-4ea8-b7a7-576993b635a0", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e6985598-5629-4b12-bce1-013ce856b8d9", "relationship_type": "located-at", "source_ref": "infrastructure--921e80b9-b599-4ea8-b7a7-576993b635a0", "target_ref": "location--a16d8aa9-c90d-470f-b91f-2daac2d6860e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c21f79ad-928f-4120-ad91-794b6604fda0", "name": "CVE-2000-0868", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-0868", "external_id": "CVE-2000-0868"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "name": "CVE-2002-1149", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "name": "CVE-2022-22274", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "name": "CVE-2022-22947", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "name": "CVE-2023-0656", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "name": "Network Service Scanning", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046/", "external_id": "T1046"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "name": "Credentials in Files", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001/", "external_id": "T1552.001"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "name": "Cloud Instance Metadata API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/005/", "external_id": "T1552.005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19faabce-04ed-48a6-9e18-38fadfb26432", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.153.162']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cd29972-3f39-47bb-a921-839d6ae44e2b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.33.80.42']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--472ea49b-6a64-45d0-b25f-a3f3f35079dc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.18.62']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adc4f450-2d53-491e-82f1-22caf0b6131a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.20.180']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf8e20e-ff92-4f8e-887c-87ce314629b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.26.245']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a1493f6-a16d-4fde-8cf0-819e4709e238", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.220.161.64']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cacfbe2a-6af8-43ef-8cf6-696ec151880c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.220.161.85']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b1b47d1-296f-4f49-b9bc-710e76cb5c39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.220.161.86']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d1595f7-cb9e-47bd-81be-4417ab123494", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.221.134.29']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76456028-641a-49c8-8fdf-a4c72622c9f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.64.167.134']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cda04ce-7a62-4f6e-9da8-b2cb4bcd335b", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.230']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a9bf9dd-1fd1-4522-a6ce-568499ee9e3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.153.155.96']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd65c08-7370-4545-b762-f98fff462b94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.159.172.5']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b58b7c2-94d6-486c-8cde-ba3329c7f93b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.196.9.72']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5a5e3ec-9b2c-4231-b6d4-bad5d1ed623e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.217.99.116']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2af10dd8-aa24-464f-9431-04a13c15dcc4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.218.241.128']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae634394-0f4b-404e-9261-c2d3445d4551", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.233.89.117']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90f6022a-9980-4b2a-a5c2-dec79e9a450c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.238.115.247']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336a57c1-35b4-494f-adc4-badce9c6134d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.241.45.120']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15135d32-7959-4709-8983-57cace22513d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.245.97.198']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88bbb85c-af9b-4608-ac74-3696172130a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.251.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12c45506-7f97-4da9-a519-6f1f40b0dafd", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.54.67']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--497bf7f9-7126-4196-8909-460314aa71ff", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.82.120.198']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a5f174-fb7f-4fb1-acab-bd9c3de80e12", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.37.62']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cdd6a55-4449-4ed2-90f6-d5fc7cb6758e", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '104.196.127.152']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ac652729-3fb9-40f0-a9af-622fd4291a62", "relationship_type": "indicates", "source_ref": "indicator--0cdd6a55-4449-4ed2-90f6-d5fc7cb6758e", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--322a5aa0-ef4d-48e8-bd5c-6e7745170d37", "relationship_type": "indicates", "source_ref": "indicator--0cdd6a55-4449-4ed2-90f6-d5fc7cb6758e", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16c6838d-da5a-4285-bafb-6cf1b39c055d", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '104.199.16.54']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--89fade3f-4cc9-4acd-bdee-77a79342b163", "relationship_type": "indicates", "source_ref": "indicator--16c6838d-da5a-4285-bafb-6cf1b39c055d", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2776ffc5-ff34-4a5b-9d98-17c41f97bce9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.196.78']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ee76488-5af3-4dba-8956-a53b62e05955", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.201.80']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a31890f-930b-495f-b813-a816e1c6a587", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.157.112.34']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c293527-81d2-46eb-842f-e72f9f3bf379", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.214.96.160']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--282a86ae-518f-4622-a5f1-bff8b818de89", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.245.112.159']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf7353b-8342-4c01-97ec-bb9e7d4441ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.77.211.60']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70c7d69c-f3bd-45bf-a303-8cac1e644ec2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.52.171.40']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba43be0a-abf6-438b-87ce-67cbd405e16d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.75']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4f3aa0f-6347-42dd-b152-fc3f83404b90", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.227.115.40']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74ac4a4-74a6-4345-a2aa-5ff238aa7857", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '109.238.86.163']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3660c4d6-77de-41a0-8ced-eb2d158fd1f8", "relationship_type": "indicates", "source_ref": "indicator--e74ac4a4-74a6-4345-a2aa-5ff238aa7857", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eb5e8a92-3890-4a54-b918-6a0759fcfed3", "relationship_type": "indicates", "source_ref": "indicator--e74ac4a4-74a6-4345-a2aa-5ff238aa7857", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a7552de-3034-4161-aed9-d063910a7d33", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '109.238.86.181']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5a1ce78a-de38-4101-b9ad-a5caf9bba070", "relationship_type": "indicates", "source_ref": "indicator--8a7552de-3034-4161-aed9-d063910a7d33", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0c5465c-bc2d-476a-b08e-2076ebaee280", "relationship_type": "indicates", "source_ref": "indicator--8a7552de-3034-4161-aed9-d063910a7d33", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6591c01d-30a5-43fa-a122-38f1037df446", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.38.15.176']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a16f0a1-df21-41b8-aa7d-dbec1aefa33c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.42.208.131']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcf3b49f-d7a0-48dd-a08c-25d8e48d9ed5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.196.183.160']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5aa6b84-70fc-441a-8821-f5d06896bb63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.109']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b4b5830-2db8-4416-9fe0-0e6def22a8b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.11']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d404e05-e6cc-429e-9a9d-dbe1d5b1a057", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.93.157.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a109460e-25bb-4c60-a51e-1f1a76fe9c21", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.164.234.202']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3eb424d-afaf-4b54-96fe-5817b287f63b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.128.203']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8beebc54-9868-43a2-9cbb-4c2efc065c40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.130.125']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--544d85f2-8b26-4968-bd96-097bf5351570", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.130.91']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227d65a8-d30b-4f97-be78-9222a91c5d33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.11']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c12f09f6-d986-4ad0-9129-aeb790ca45bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.135.224']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c82ca3f-b722-4831-91c9-9079f6cfe45f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b175e2-f9ea-49c4-bf5b-a35ebd921fce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29619ef5-8ad4-4976-a763-24682c71e79c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.148']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--647f72fb-73ca-4d9a-89d6-087487e3eb6e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.59']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0274f0-5f5a-484d-8a25-2c14fb86de35", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.122']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec9a6589-4671-4ee3-8bdc-778bdae7a785", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb8f16a-43dd-4022-86f7-b3541a7a2e43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.250']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0000a8a-adbf-4b42-bd3a-4278efa6be4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b097576d-0293-43a6-86fd-0a6adc29696b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.186']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--520b1cf4-a314-4268-b09f-cc835b8bf0e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df77f4e1-f94d-4ec2-9dc6-b4c8d12e5337", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.188']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--533bdeef-1fd7-4079-8b3e-bec632882bcb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.194']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b647e4dd-55d0-4d7a-9e32-25c02a765806", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.146.171']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5b136b9-837b-4ef2-9b30-828c4f5d9fd9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0efc67af-42e4-4f89-9410-a2e9b4ef6dbd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1a017d6-12fe-4b65-9268-458a6abcbe78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.128']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed5c15b0-40ad-4d7f-902e-df12ba0df78d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a382175b-8267-4978-81e5-1d33eab703f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.104']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a83f753b-4b83-4c10-8428-5edda9137d2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0029a5f5-a032-4fda-8ee4-e1681d65c0ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed1b78c-d95d-4d7b-a7c4-145257708e32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1207691-1c82-49a1-bf75-73e8190d0f4a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.156.225']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--178bc5d3-7494-4dba-91c0-8552ec49a684", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.156.86']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c78c28-d7b4-471b-bc7f-81a3073d9118", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.157.234']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f81b0f8-aaeb-4fa3-aaf4-65e4936907b3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--056ebd77-6835-45b4-956a-d8cf80fbb8e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.92']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d32a40b8-71eb-4702-a869-c1f017ed8504", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.106']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8315eade-07af-4049-82c3-6b4af25debf7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.145']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae72968-5e6d-4c81-85bb-0898cfc1fd73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.150']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8edfe6f-2469-4449-a26c-567716384fdd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e863beb2-d6a0-4506-a3d9-548bd1db466f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.20']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463a455a-194d-4a83-ad98-5b27080d4f3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.44']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aced55be-7344-4b94-9c32-0bc14c636c79", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.204.228.173']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab2c029b-a94d-4580-a1ec-67587e051bee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.101.205.152']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be7e0dd0-d3b5-48d5-95e9-c40202618c57", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.34.240']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a413764-c150-4d6f-9774-434b3e104375", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.233.253']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53664090-a91f-4911-853f-c7d36ea75ca9", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.253.182.123']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b649ee76-c85f-461e-b09d-969f82eaa77f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.154.113.213']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec35d03f-eb96-4afe-921d-4a1c69d86b5d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.236.245.156']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f940c2-0f2e-4f07-9adc-e1d50951cb6d", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '119.40.84.186']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56018de6-3a4f-4674-90fe-dca741cc37e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.45.7.86']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c7baf6-b3ef-4f42-b6f2-63fd87da7ccb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.15.129.26']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214dfb07-63c3-42ca-8a34-d6564df432c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.207.65.62']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bced88f-699f-4094-9ea4-90eeaa1f2ff3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.253.162.254']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1de2464-71a1-4ee7-9329-f12ef84a0813", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.109.51.210']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5661c5fa-f9aa-4d59-bb8c-56308fa9b9c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.220.42.101']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b6fd9e4-fb5f-469a-ba7a-bc366fd05b9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.222.230.178']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64f4e205-d863-423e-9824-48bc42590551", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.119.196']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a496dad-7c71-4421-b314-71e548abee1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.159.56.14']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d74f2c50-0119-44ef-8530-e4398beee589", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.223.3.216']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cebfbdae-48db-4535-bfa1-8f246b03fd39", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.117']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e3d245-9da6-4f4a-9c72-ab5f01b15bef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.181.23']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a62cb1c-d4b0-4a4a-97f6-9e88df4d5123", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.211.83.252']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db1c23e3-0f7e-4726-94c0-73aac84f2293", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.148.22.172']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68cd63a4-fa97-4345-a3e0-9fccf8eece8d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.255.181.69']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--accd775e-07de-4c81-93ae-a308f7b1c39d", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.111.60.94']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dfeff35f-a66c-4582-ae4c-c1ff5a667ef2", "relationship_type": "indicates", "source_ref": "indicator--accd775e-07de-4c81-93ae-a308f7b1c39d", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e1c467d-2742-4640-85c3-532fbe16de17", "relationship_type": "indicates", "source_ref": "indicator--accd775e-07de-4c81-93ae-a308f7b1c39d", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda3f707-e5fc-4a04-98be-8bbdc46718b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.144.43.127']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5a061d4-c82e-4f5c-b485-f08efb885f3d", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.69.172.26']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ac21beb7-a547-4d50-b6d1-4c01d7331e57", "relationship_type": "indicates", "source_ref": "indicator--a5a061d4-c82e-4f5c-b485-f08efb885f3d", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a015601-bbd5-45bd-8085-aee09f2dcb53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.69.175.10']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f501970-9e56-4438-9037-5c916b82c29c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.49.38']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79a8c1c5-3378-4d28-a1bd-3c30d8c09961", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.142.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25623b70-28eb-4857-9a77-64ecd5360866", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '138.199.19.158']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d77b6bd1-b204-4ff4-83b4-283619596a19", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.246.253.24']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81c4a9b7-e554-438e-ba9f-ff10d3898691", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.137.26']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ccf894f-0c15-4dc2-9a5d-2b6fa126a40f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.44.162']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eb62f56-ac54-448f-970a-0b0421633c49", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.118.132.42']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1340f61b-0267-4d24-83b0-5482071de6d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.167.249.242']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d63b962-3980-4ecf-a2bb-e6a606df780d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.191.61.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c65271f-1de6-4d91-b8f2-dada0bab4d11", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '145.220.91.19']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--582847fe-87d5-42ed-abfd-ccbfa25d558e", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.142.30']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc72324b-bae6-4ef7-b27f-035ac037d60e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.56.197.150']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad8de70-3fa4-40c4-9feb-fcf797005737", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.132.115']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b392638-3cfd-4e05-bb5b-9dc165e333bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.36.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b540a048-a1c1-4e90-b8b2-6798df0cf6a8", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.36.132']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c008e241-dee6-443a-9b36-93808164551b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.40.68']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc2fe091-53ac-4084-9309-f1736364bb0d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.168']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d3296d-6835-4306-b009-fb5ef88f80d9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.34.48.31']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972e43db-7feb-4014-b199-37276970197f", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '149.88.19.87']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fc09206-359f-4b39-9475-f728af1dfa5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.130.217']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56542c43-349d-4f2d-91b4-286265418f48", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.218']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd8f10c-85e1-4a0e-ab4d-d1529517a35b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.236']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a00155-17b5-4466-943e-dc05772862f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.48']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a06fc11-094c-4a82-8678-80e3cd927007", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.133.140']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ef1600-098b-438c-ad20-0b276f9957bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.134.51']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b310c58-fc78-4f84-90f5-ed00f67c7bae", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.245.151.145']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b91bb97-34da-436c-90ab-f53bd8dded83", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.42.151.211']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a747595-b740-424c-9892-77eb1ac8d727", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.136.23.159']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c2d517-64b4-4652-a94e-fe03ce3d2cd6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.228.236.214']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5154a340-2eee-4fdd-bbce-45820e63cc56", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.188.3']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a2120b6-4411-4080-ab31-95790bcc6540", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.216.39']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dc3bd29-4fe9-4b99-8dfe-4103f8de82b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.61']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa3013fd-a4f0-4a48-a9ac-9fc2adaf97dd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.50.248']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59aa0425-f69a-47a1-86d8-35305df9f541", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.246.198.45']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ccaa56-9f2f-467f-86c7-742916645dbf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '155.2.215.61']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae5575bb-9c22-4f7e-934f-e344717f5ab4", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '156.146.33.66']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1461cc77-87b8-4063-8120-c02f052d3404", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.18.133']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d6c643a-a87d-4469-ad84-f85e72a6c032", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.90.17']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238eceb4-a047-4ca5-ba06-1b494bf7a077", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.4.122']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07821fe4-a5c1-453e-8ea2-7347fd7d7656", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '158.23.162.109']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1609e935-8673-4ccb-94a3-79aa45c8ec1b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.69.73.185']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a026d7f-fbb7-4fd9-aa03-4e256ccd43ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.236.248']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e86c609-b519-48d0-8e50-68155c9841f1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.19.19.234']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb54e829-0c66-40b6-aca2-4286acf5aaf8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.231.139']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617a9309-fd4d-4100-a761-9d275acffb32", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.142.117.15']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0daa716-06ef-4e09-9f2b-d2eaa92cc5a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.14.110']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f11fe54-cc34-4346-83d9-20d973de2e8a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.14.114']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be6726a0-260e-4690-8836-11deab63d27f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.14.227']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff9ce763-ccc9-4f19-8e4e-0f74ba854e3a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.16.187']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--966ac8a2-0028-46cb-b86d-78fe5af421cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.1.138']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12fc1576-c5e3-4eb7-9800-7799c43139d8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.104.92']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc423e3e-96b9-4457-bc1a-92cf38e80e2d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.84']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a65c8db-9231-4a3b-bdce-90e5b5152752", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.166.25.31']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9793e3c6-c2f7-4f47-ace3-eda1846f4a29", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.180.153']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc65af76-1308-441f-8b6b-0e8e126b7206", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.35.153']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2840c01f-4fa0-4d92-be21-8523bb2b0fca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.37.134']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0163686-9680-4f63-95b7-8e5e43bed17d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.205.28.115']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4be7222-caab-4e2d-b7bf-42523d03ab51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.245.166.32']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3d64583-f228-426a-8dd6-363a61986f12", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.156']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3daed87-0996-44bd-b90a-9a52e959fcdb", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.207']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a995725-e6ea-4e28-ba6c-3e3de37e5e31", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.243']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28744707-c435-40d8-b8ca-a8f31e04dd7b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.82']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd06a480-afda-417c-ad35-79173cfb2580", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.59.93.176']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae01f26-0c48-40e5-a00b-2fd58c6e2fb3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.86.81.177']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b84b43e-f42b-4283-bbc2-9c766df82a2f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.86.84.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceff95fe-b0a3-450d-aaa3-6a927f2dceb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.98.33.86']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541d75fe-9523-48bc-bb23-97018fae07ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.211.211']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c8e3b07-50fb-43a2-8a35-aa84158f46dc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.110.90.134']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb1d5fb-711b-45c1-bcb1-b7e347b5f535", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.36.108.88']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--251f7dba-6649-40c8-ad5e-1d8f042898f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.35.193.155']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf9a67f-0254-4cae-b8f3-55080081a889", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.8.53.114']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2c79bc2-e21d-4e1e-9e31-3d67e3d26ae5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.26.122']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dbaeb80-6999-4401-ae20-f43335c7dd43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.130.101.230']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ad1593e-2cd4-4926-9287-f7253a2ecfa2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.159.37.53']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a64cf017-da69-4005-92a5-3754f60fce50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.53.150']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba561fa-6ccc-4624-aa15-f03c246faa8d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.54.246']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d5c29a3-4737-488c-b7ba-ca240f41d166", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.204.251.124']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fe497d3-82c5-4f00-822c-74644a76593d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.216.208.174']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6e2b90-986f-4083-b549-36e6face343d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.73.227.32']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d17c1e-fadb-41be-ab77-c437e3d2c176", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.93.200.29']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a91e359-9257-4b9e-aace-12d39c43a401", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.124.182.181']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c6488bb-882c-4a2e-905f-6f2486195cb4", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.183.20.2']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44afa2f-b5e3-4e73-8a97-4c1d03b58aec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.41.215.76']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373a0780-e301-4696-8ece-bcebfbdc3aae", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.3.170']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15a97083-6819-490d-909b-05ce479dbe98", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.252']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69419243-90e6-43f4-b676-f68e983f0e65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.139.167.180']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcf08db-6d85-4664-86db-0e36228cf9be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.143.11.43']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66283cd4-3727-437c-8313-0ba009e36598", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.189.198']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79103c57-61c9-40ad-b205-088719425307", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.205']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d38538-8b19-4145-8312-1909050e650d", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.19.40.179']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--128be7d0-4ea0-42b3-abb9-c9cc6c09198b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4774eabf-ebd2-47cc-bbd5-a43b0e6f1e51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f15a94-904b-43c4-a847-f2f735702ff6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a913f91-0900-42bf-924d-91054d8d3bd7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054ee24f-6c71-4e53-8ac3-73da1cc94af4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9433cb2-c788-42af-99d7-3976367b9f71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b95055-ad9f-4c53-9ad6-b6c225301e80", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dcc7fb2-f852-4c3d-adfa-571e4afbf420", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aafc60b-7345-4dbc-81a3-ef6004e797f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc3c7b44-b8de-4983-a93c-556a4d734d3f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39858d1d-83c7-4dd5-a6b9-199776bcaee7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38140695-4518-4fb0-bf02-2284e60712d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e8ef37c-8837-4668-b20a-edda3b144e07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a815a488-fc02-43a1-a45c-9aec0b464184", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae98c155-44a4-46b2-9218-87a78afb7725", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66c20e5-de61-4f69-b767-ff796b422e4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c55590fb-96ff-44f9-934b-7896d91a7027", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fea12f57-9b7f-4672-84d5-1cdac2f53a4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be11fbcb-f059-448c-9257-ec75298d25b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a3de328-3d0d-4f9e-a88e-f150a0b43488", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.218.86.10']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26fa9c07-c5d3-4e2c-9c12-5aa2e98da536", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.65.135.230']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c9e3bd-2338-4fed-beaa-66bfa451412a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.95.156.182']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78d0d409-2c42-4fec-8a97-708db7f50a9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.11.10.72']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c843ff4d-2135-42ae-b5a4-cd84b20c6119", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.236.5.47']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb6d7729-80a7-40b1-bf34-bccd41bae88b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.61.94.228']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3216d7d2-aacd-4ec6-a046-d530fc8de64b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.62.234.12']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30be3e90-4b36-43c3-a8a0-672e8073d7de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.94.160.43']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2589d35d-9a0e-42e1-ad3e-6edab73f3c09", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.165.137.186']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58a2e779-e4c9-44be-b972-f896179748d5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.233.122.166']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--209276ea-d9cc-448b-8e76-01d370dd5f73", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '188.95.65.43']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9803cd23-ebe5-4b2d-96be-da4582a340db", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.6.32.107']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56161186-9d2c-4122-b690-e800a0245b50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.245.53']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b7ac64-3e47-4cee-a70f-b290a2c9c795", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.121.159.23']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--347be630-8b95-49f1-96ec-74056f1e82d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.121.38.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42463d46-6846-4544-812a-93b6c1e23786", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.121.71.242']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bba3a14e-8deb-41d4-bf62-e30ac3b33e79", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '192.145.125.68']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79f130e7-a490-4102-a1ab-eeadbcacb2bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.185.83.71']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1cd534a-7348-4987-8f91-e6937b3eb75c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.67']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df07c313-96d4-4b73-93a2-5a45e92730c3", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.46.221.9']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68b1fffa-f093-441d-ba2d-61c80094db2e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.143']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71bd9f60-3495-4106-a58b-5b2297ed2375", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--927baf6f-6c9e-45d2-ab47-cee726bb5247", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.218']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa17728a-ee5c-43db-ad75-6aebe780ab7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.135']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3ed568a-377f-4605-b2bd-f77f83ca1adf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.154']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db79ad5-d908-4504-bbea-717d5a120f44", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8efbdbee-07bb-401b-bba3-9b3280669331", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.47.62.69']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e63b2bd1-2ad4-4d50-900d-00ca6b036182", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.71.102.182']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1dbf00-44e3-4354-8cd1-525d27347bf6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.164.49.144']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1dea3fe-bd7d-4d6b-be6a-9946751a9e44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.177.94.28']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10c7e201-71cf-447b-855c-a0487cf8d749", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.204']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1179aaa-342b-47f1-80e1-45b8b90090f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.217']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2cfed5f-118f-4828-ab93-00542a72c544", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.3.220.7']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c490aeb-e49b-4108-bdf8-82c7503981a5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.78.100.163']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab508140-ae07-4198-a7e2-7b54fe5ad869", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.64.152.49']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f4782ce-074e-47b7-a590-f8289e69ecc2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.65.147.47']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fef6225b-0d8a-43d5-9d75-18e5f51a39ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.221.232.44']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d853aba2-609e-4cc3-b1dd-8c1adf7fa1b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.65.49.79']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df5ed9c-4b19-4bf6-b47f-871434a60b4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.95.38.38']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54b7e83f-a818-44cd-b656-bfe532a69775", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.150']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8627aae9-0c83-4ef0-99a9-a8e229405612", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33013f81-b98c-4607-8006-5c60dc95a05b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.244.200.163']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fa94690-e32c-4148-881c-30ed75563bbd", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.195.252.209']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a548fd03-d271-4b6b-a343-614c03cd5146", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.244.88.227']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cae65ac6-3736-4164-b4cc-d2d7aae784fc", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.184']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46da3562-de82-4231-a084-dd67d88f1913", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.190.134.32']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9caa6064-71d1-46ed-b96d-d65a95cee8ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bf345cf-47e4-47ed-8d49-b9c3700a3ad5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.150']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4514e0b2-aaa2-423f-b464-82ee3a6c385e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.168']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.202']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f7c1a11a-7f89-41de-83c9-d3cd5cb8c4d7", "relationship_type": "indicates", "source_ref": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec78e864-c68b-4970-b020-168e1290044e", "relationship_type": "indicates", "source_ref": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8977492d-6d79-44ed-ac30-959d81f032b1", "relationship_type": "indicates", "source_ref": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0da8600c-9f59-4f35-86a7-9171f566250e", "relationship_type": "indicates", "source_ref": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dcc7af7f-24ae-4c8a-a33c-95c1650c01ca", "relationship_type": "indicates", "source_ref": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8fadd79-ae7e-4b98-96a8-d91e0b24c94c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.112.235.167']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5be07fb-4daa-4dff-a279-97daa6d1dd23", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.121.65.178']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e8e0cac-31be-47b3-9d43-4b7ee864a73f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.24.86.237']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d16904-6005-4453-a0da-0adecc0c9495", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.35.80']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09fe8c53-04d6-4517-b31c-64254b4c62cd", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.166.5.18']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c15e234-325b-4d37-9cdc-bbed11ef2fee", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.189.22.86']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5166f854-f98c-41b9-881c-ffb34371472a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.220.170.156']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--216fddca-d673-4da0-afa3-02a874a17d6e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.159.87.164']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db12dd8-21f8-4e88-a183-1f1eaf795264", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.192.183.80']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f5c8181-c7c4-4413-a0b0-c7b695c1cc66", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.239.160.29']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b56b505-e4f4-4cf6-8885-dfee619e488c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.78.202.153']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fbf1fae-dbb9-41d0-b518-00064d39c7c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.59.209.37']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84958e64-d513-4042-8c85-45b2bc3c135c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.78.167.217']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7489a4fc-6067-40c4-8546-1564e5434905", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.20.109.227']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb10e05-5ec2-4aae-af5e-4f13e22f8ecd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.0.2.202']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92a5343f-0db1-4ee4-bd05-2efbb67172dd", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.134.98']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16cc8c8c-0953-4a7c-b8ec-f48d23cbccb6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.84.80.77']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fccae0ab-e725-47fb-ae44-808e83def3a4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.166.168.11']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8869bbeb-9bf9-4ca0-923b-248b5ba0e0b1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.166.172.198']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b265ec5-48ef-46dd-897b-7d038158c77d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.46.13.229']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d84a24-dfc0-4e9b-aff8-c59b00d4e7f6", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.10']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55889582-099b-4c7f-b069-a1e1f098099e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.20']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0517ce65-41b2-4bb3-ba3a-a1760a45cedb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.42.48']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6167153-373c-4062-b1a1-45d9f2d2ce3f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.240.111.185']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f612ea4a-0bfa-4a81-8958-1f32822bcf55", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.72.14']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a2c58f-2b9c-4431-9cfd-46f77097affb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.79.182.252']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5935b1-cf4b-4747-9cf9-0a11e1006507", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.44.250.201']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2e034a-5ef8-4a35-9a81-6ff87ca274e4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.98.3']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19322f82-6f5c-44c4-b17c-a0234bf73d4c", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.133']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1e3051a-c194-416f-a7e8-c51eb6117308", "relationship_type": "indicates", "source_ref": "indicator--19322f82-6f5c-44c4-b17c-a0234bf73d4c", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53dfba0c-e454-44fb-8020-d5edd4bc0e2c", "relationship_type": "indicates", "source_ref": "indicator--19322f82-6f5c-44c4-b17c-a0234bf73d4c", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--55e7e776-38fd-4e67-988a-bee2b93d3d61", "relationship_type": "indicates", "source_ref": "indicator--19322f82-6f5c-44c4-b17c-a0234bf73d4c", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.154']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1224a76-4eb8-4171-905f-24db900e148c", "relationship_type": "indicates", "source_ref": "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c27142f6-f2c1-4c17-b4d5-6eaab0a5fdda", "relationship_type": "indicates", "source_ref": "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d05b8af6-aadb-4371-9a9d-700339c07bf6", "relationship_type": "indicates", "source_ref": "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--703ef944-9083-493b-b70a-3af00a52329f", "relationship_type": "indicates", "source_ref": "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.175']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf6b21ff-8455-4f60-b596-950af6b8c20f", "relationship_type": "indicates", "source_ref": "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d55ef87-3664-4a35-b641-5c8cdb83a696", "relationship_type": "indicates", "source_ref": "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4782e558-58b1-4172-adc8-321a07d8d523", "relationship_type": "indicates", "source_ref": "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e13a97fb-ff4b-4244-a1c8-529121968f3a", "relationship_type": "indicates", "source_ref": "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9423b1d9-21d2-4206-8cee-8c1a4f0c5a9d", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.84']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c838b062-ea2e-4c5b-abe7-8e45d1efee83", "relationship_type": "indicates", "source_ref": "indicator--9423b1d9-21d2-4206-8cee-8c1a4f0c5a9d", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d14dd551-97f7-4a72-a99a-15545f2da6d0", "relationship_type": "indicates", "source_ref": "indicator--9423b1d9-21d2-4206-8cee-8c1a4f0c5a9d", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--318f757a-5c57-4120-8883-247c5d50f9f1", "relationship_type": "indicates", "source_ref": "indicator--9423b1d9-21d2-4206-8cee-8c1a4f0c5a9d", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--191c5709-10c8-418a-aafe-bba5e932df32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.24']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5dc93ad-fab3-4dde-82fc-b5b4381064e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.67']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f8ea8fb-1d84-4c71-b465-3b575e13a7e9", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.118']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76ca79a-ba10-4132-841f-fce4b8ff1671", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.21.182.228']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38d645d8-fe0b-490f-a523-80615877e14d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.105']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6e9d880-7451-4ec5-8512-c02239723fff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.81']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1ce8126-9af0-4d2e-b3fd-4e53d3dc170f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.162.218.85']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d27482c-1c26-40ee-bb62-efc9ff2fef62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.84.221.194']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39832c21-ed94-4d9e-8492-6875a6fc2dcb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.199.117.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfb9a84b-74de-412c-9fb1-f1fbfe5ae4d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.130.222.223']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05ab9338-3cf5-4501-b3db-88defa390950", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.34.65.97']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d6cb07f-501c-457d-93bd-46bc58730121", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.220.121']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80770f02-fb04-4c7b-87fc-08550b473429", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.58.236.217']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ec69f05-11a0-4cac-851e-d31babe44dd5", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.70.77.230']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223c8ebf-d4d3-4f63-90b9-db8bdfd3eff7", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.122.88.167']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8ba24508-1d2e-40a6-a85d-4c29162928f7", "relationship_type": "indicates", "source_ref": "indicator--223c8ebf-d4d3-4f63-90b9-db8bdfd3eff7", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--81bed110-565d-4c7b-bb3d-70569374fb07", "relationship_type": "indicates", "source_ref": "indicator--223c8ebf-d4d3-4f63-90b9-db8bdfd3eff7", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eb1c24c-2d3f-4a42-9f51-de62aedd96de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.147.225']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e894524e-eb26-4bb6-8336-f204dc6dd441", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.234.80']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba40d5b3-f9f8-4b0b-ac18-033bc73836bd", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.148.175.137']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e340464f-0edc-4f43-83e5-38b21052069c", "relationship_type": "indicates", "source_ref": "indicator--ba40d5b3-f9f8-4b0b-ac18-033bc73836bd", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.100.73']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--029b5dbe-8853-456a-84d2-5050b26a340a", "relationship_type": "indicates", "source_ref": "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5afb4daf-5d8e-496f-8062-20c65912e567", "relationship_type": "indicates", "source_ref": "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e0b03ba-242b-4183-b3f9-5eec86e7b556", "relationship_type": "indicates", "source_ref": "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c6db6b62-886f-452f-8f37-291af8d00ac6", "relationship_type": "indicates", "source_ref": "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3407590-910c-4342-840f-9b74eaf9f0f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.177.199']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39b87c43-18c1-40db-92db-dfc55c495206", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.206.32']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d3fbe3d-c1e0-4f4e-8c7f-f259b8af365c", "relationship_type": "indicates", "source_ref": "indicator--39b87c43-18c1-40db-92db-dfc55c495206", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e3672c1-6248-4207-87c3-0162a1bbacc3", "relationship_type": "indicates", "source_ref": "indicator--39b87c43-18c1-40db-92db-dfc55c495206", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--727489b8-2edd-4fa8-80b9-d14d3f322350", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.212.48']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45768ba0-2c74-4c87-88e6-1be62ce705c2", "name": "Malicious Host", "description": "Observed: WEB activity. Web exploits: aws-credentials. Sensors: cfglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.22.222']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:revproxy", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--22718cce-7577-4823-9e11-2ce557e69791", "relationship_type": "indicates", "source_ref": "indicator--45768ba0-2c74-4c87-88e6-1be62ce705c2", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c86f8d3-02db-4cd8-8e60-21f8697181fd", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.249.47']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67192102-0776-404a-899b-5916b9177d6f", "relationship_type": "indicates", "source_ref": "indicator--7c86f8d3-02db-4cd8-8e60-21f8697181fd", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b2fb60f4-99a1-48f7-a807-6b86f5ceeec3", "relationship_type": "indicates", "source_ref": "indicator--7c86f8d3-02db-4cd8-8e60-21f8697181fd", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2d2be9a-76e7-49ce-a0e5-b729e765d6b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.217.178']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8a8594b-2e51-4782-ba62-3a4ed251498c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.18.146.23']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80767eb9-3941-481e-b875-d71e220191a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.182.123.75']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.182.156.165']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8a2640de-9dc6-48ba-829c-e1d56254aa18", "relationship_type": "indicates", "source_ref": "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa4b0af6-9749-4f8f-8a49-c334b0419364", "relationship_type": "indicates", "source_ref": "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--395ff326-87d6-4a30-9db4-9f6a56181f09", "relationship_type": "indicates", "source_ref": "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b00afdc3-3c6a-4173-b5d7-c235abe39b69", "relationship_type": "indicates", "source_ref": "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--320045aa-9a52-441e-bbee-57222a98bf6e", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.185.155.95']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c8ad2991-7461-46be-b60f-7bf4e330cccc", "relationship_type": "indicates", "source_ref": "indicator--320045aa-9a52-441e-bbee-57222a98bf6e", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a270524-301a-4d2d-bdaf-2598e8e8f287", "relationship_type": "indicates", "source_ref": "indicator--320045aa-9a52-441e-bbee-57222a98bf6e", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54281e82-d7df-4e65-88b7-3284bd6a88b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.206.50.36']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cbdb823-e5f9-466d-a7f6-2782c58a8d1c", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.219.139.198']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f4020ef-1bf6-45d6-942c-56a01394ee82", "relationship_type": "indicates", "source_ref": "indicator--0cbdb823-e5f9-466d-a7f6-2782c58a8d1c", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--acd570cd-b15a-45f7-999c-d3de1134f885", "relationship_type": "indicates", "source_ref": "indicator--0cbdb823-e5f9-466d-a7f6-2782c58a8d1c", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720f9039-2366-438f-aac8-9e749bbfa2f1", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.23.170.6']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.32.25.189']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--520ed925-124d-438f-a5fe-6bfca8d4407b", "relationship_type": "indicates", "source_ref": "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--03305de6-b2cb-424b-b418-76bf07832170", "relationship_type": "indicates", "source_ref": "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--18cf30bb-2c8b-4509-a7bf-5c7ee78deb5b", "relationship_type": "indicates", "source_ref": "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c7e6477a-d500-4f73-9fba-10fd31c2e4c8", "relationship_type": "indicates", "source_ref": "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1059aa62-97fb-4b62-81de-aafd0401087a", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.164.159']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b8ff48e6-9865-4a81-a8bc-dd3c846b9cee", "relationship_type": "indicates", "source_ref": "indicator--1059aa62-97fb-4b62-81de-aafd0401087a", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff6e6c98-400b-43cc-8639-dd352766c75a", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.113.44']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6cac0fc6-5da3-4cdc-987d-e0eaedea6891", "relationship_type": "indicates", "source_ref": "indicator--ff6e6c98-400b-43cc-8639-dd352766c75a", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.156.20']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da04fbea-f176-4c1b-aae5-aa3e0a7204a8", "relationship_type": "indicates", "source_ref": "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1d04083-6f7c-4829-88a6-af07116e5917", "relationship_type": "indicates", "source_ref": "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f41677d-c04e-4658-970b-41de6d0c8e92", "relationship_type": "indicates", "source_ref": "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3afa7a7a-f85d-40db-a677-e0636d58d9ba", "relationship_type": "indicates", "source_ref": "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--371d9026-7bc9-4f50-a3a4-775da188f507", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.229.253']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a91e10af-4619-4a88-a0dc-97ab9dfb4b16", "relationship_type": "indicates", "source_ref": "indicator--371d9026-7bc9-4f50-a3a4-775da188f507", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8ac1cfa-250a-4855-904f-090caf379172", "relationship_type": "indicates", "source_ref": "indicator--371d9026-7bc9-4f50-a3a4-775da188f507", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e62e1cfc-5c54-461c-bb29-47de4dbd3ee6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.54.165']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2000-0868, CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.82.165']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-0868", "external_id": "CVE-2000-0868"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3522cb24-eb29-4ca2-8bee-1fdb8b4f9c3b", "relationship_type": "indicates", "source_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a36804c7-96f5-40f0-b770-cf8668ee9ea8", "relationship_type": "indicates", "source_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5562069f-d0b0-4371-aad2-512112e56c19", "relationship_type": "indicates", "source_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--12a3785c-28a1-4e4e-b0cc-6ea36dfc4892", "relationship_type": "indicates", "source_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "target_ref": "vulnerability--c21f79ad-928f-4120-ad91-794b6604fda0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--623e5444-7bac-489e-8988-cb817593a5f9", "relationship_type": "indicates", "source_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--757c1034-79e0-47ee-abc5-4b83c695d109", "relationship_type": "indicates", "source_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.65.175.91']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--95802895-2b7d-44cc-9182-4709435d8c34", "relationship_type": "indicates", "source_ref": "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67730189-ec34-4a3c-9141-bc0f15205835", "relationship_type": "indicates", "source_ref": "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4154f47a-6de8-4d1f-903b-391dbe85af6b", "relationship_type": "indicates", "source_ref": "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da524a19-a788-47ea-83b2-55c3ee6db25e", "relationship_type": "indicates", "source_ref": "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.75.82.186']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c36a7db-0e60-4ca3-bbeb-7a8df93c8244", "relationship_type": "indicates", "source_ref": "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--10414b8b-ff21-414a-957d-89c04688b679", "relationship_type": "indicates", "source_ref": "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b9b5a055-640f-4412-994a-bac841f199cc", "relationship_type": "indicates", "source_ref": "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e160898b-d8c5-4dd8-84eb-f51ae3777701", "relationship_type": "indicates", "source_ref": "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6193c6f3-219c-4020-a0d9-2b706d9e6df6", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.137.207']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d1dd6282-067d-49d5-88c2-478a5e010452", "relationship_type": "indicates", "source_ref": "indicator--6193c6f3-219c-4020-a0d9-2b706d9e6df6", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bdefe78f-1c1c-43c0-9c07-da2f105b465d", "relationship_type": "indicates", "source_ref": "indicator--6193c6f3-219c-4020-a0d9-2b706d9e6df6", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--daf01acf-2bfb-4ebb-b8c7-8d6135587c29", "relationship_type": "indicates", "source_ref": "indicator--6193c6f3-219c-4020-a0d9-2b706d9e6df6", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12a28aa-d4d0-4c41-a27e-d1d9f22540de", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.78.135']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76dbb022-a92c-4f7a-aadc-1ce2ce79f3a3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.114.97']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb5f6071-e33b-4b4e-a7df-54582d1c1ccb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.228.19']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cbfe2aa-c405-401d-87cb-647a414bf315", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.73.41']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.87.254.44']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa3cb80a-022f-4be4-a688-5709a138ac54", "relationship_type": "indicates", "source_ref": "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e70524ac-b886-4115-9a4c-e8b4c4182c7f", "relationship_type": "indicates", "source_ref": "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--963e66dd-4403-49fd-89f1-2f5cc7437ddd", "relationship_type": "indicates", "source_ref": "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "target_ref": "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3c608235-97a1-47ad-9ec5-9b2b4c28c8cc", "relationship_type": "indicates", "source_ref": "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "target_ref": "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bafc03f-1b2e-4c10-a9ca-afea3fbb87dd", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2000-0868. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.91.82.229']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-0868", "external_id": "CVE-2000-0868"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ee6b316b-ae65-436e-a41d-bb2701dec727", "relationship_type": "indicates", "source_ref": "indicator--1bafc03f-1b2e-4c10-a9ca-afea3fbb87dd", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c49014b-7cca-4d6e-8bab-d33c6dd41624", "relationship_type": "indicates", "source_ref": "indicator--1bafc03f-1b2e-4c10-a9ca-afea3fbb87dd", "target_ref": "vulnerability--c21f79ad-928f-4120-ad91-794b6604fda0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9313eda6-6eb4-49c8-a7d6-582b0ac65ad3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.93.212.106']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb810d13-1d72-4037-9f84-fb4b3c1b6c0e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.146.83.99']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9927899-48cb-4af4-8fe0-7bc17bf549f8", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.188.250.239']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e8639a-393d-4a10-975f-9faa9d646759", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.68.216']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7800d8de-c47d-4895-9140-0b4ea6a5825a", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.234.18.193']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f30b4fa-32d6-4da7-b69c-26c250f7535f", "relationship_type": "indicates", "source_ref": "indicator--7800d8de-c47d-4895-9140-0b4ea6a5825a", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be5ddd2d-dddf-4d34-817e-cc1515afabd0", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.100.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fbe84e03-a3e0-439c-8cdc-e6f12df4d0e5", "relationship_type": "indicates", "source_ref": "indicator--be5ddd2d-dddf-4d34-817e-cc1515afabd0", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e70b9712-4a1e-470e-bdf1-11d58cdb4b83", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.87.110']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f1cc8c-6c0b-4c28-9188-4ae6b249106c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.220.119']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f102c45a-0480-4cf0-9586-b591c80624d7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.83.226.155']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86be901b-daf9-4eec-9664-642438c79dfd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.131.42.232']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d18bee91-62d9-446c-8ba7-0906618c63b2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.221.113.13']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dff9e4b-efaf-4a28-af6f-bdf391009eb7", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.255.220.246']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e94e2222-bb3f-4367-a6df-34bf583cc919", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.224.81.123']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30255714-bd56-44dc-810e-60ce8736dac2", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '38.246.114.117']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--acdcd32f-9143-4515-b230-95d4e2763e9a", "relationship_type": "indicates", "source_ref": "indicator--30255714-bd56-44dc-810e-60ce8736dac2", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--424eee9b-ea93-4621-9065-40dbbee00022", "relationship_type": "indicates", "source_ref": "indicator--30255714-bd56-44dc-810e-60ce8736dac2", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5086a3fc-0bcf-49f0-bd28-3d21b93773be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.250.135.171']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d717181c-e61e-4c15-806c-81187ca1fc4d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.46.193.0']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc7a905c-2338-400e-b770-35a39795fe46", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.59.22.25']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0093ee09-caf8-4d89-9392-866db1598a1b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.59.6.148']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45b03561-a129-41ac-9507-5132440721d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.61.125.1']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d5e1d28-df1f-4fb7-a216-fbb6f0dfc1e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.148.8.97']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761029a2-00e1-4c15-b4ca-a388af57dbc4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.232.64.120']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e1efa34-fd1f-4980-ace4-cd1814c9e62a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.116']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5075d238-85ac-4e04-af11-873b00d4f7dd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.151']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58c488bc-6b43-41b5-96f2-bca25d64b9cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.157']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--427f6cf7-acc3-46c1-9f49-eb27c4ace034", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--615be48a-86ff-4001-ae6b-42b4aa24b91d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.235']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3a74d88-fec3-4d6f-8bb5-514000d52550", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.4']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0667ab5-b879-4015-8a2f-215ff7003e53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.40']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fff93e92-f7b5-4459-8654-f8cd04c03e81", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.41']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fa1da65-68a3-40e9-a744-5450a4c44433", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.7']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c5a702c-3b0c-4b5c-8b55-773914fdb51f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.70']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aed41e06-5483-44ef-928f-86a35c0a8167", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.71']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49fa2b52-1ae4-4470-90cf-413f990c922a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.193.37.145']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b546675-0954-4484-ac0a-a4f44b8de0e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.82.122.52']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01ec627-ea3a-4e2b-9173-9428def57413", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.239.153.199']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--355bcf30-ee75-4ef1-9909-22c67f77f056", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.106.59.7']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--503fa007-9fde-498c-bca8-2c37df15f751", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.100.35']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f07b4177-8640-428e-a384-76d63b5b141f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.71.237']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e27ed6ae-50f3-4cfd-bd6e-c1004ce80b07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.32.36']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7926e513-0810-454a-bafa-c22ea3c6c682", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.66.51']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ac2dcb-f26b-4163-ba2d-f822e3d8a9a4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.49.202']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae25f092-edd6-4bff-8686-a6d58f6b3793", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.96.204']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfe4cb17-83fd-4eef-8067-57d2acc0d740", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.13.113']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea8fe99f-f77e-4e1a-872e-84979e4cffce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.157.239']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af12abee-3ff2-4129-9658-a8ce3f309f62", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.71.43']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d246071-a625-474d-ae1a-bbe679251c62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.22.57']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8acfcebe-01ed-45af-882a-160974842142", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.46.118']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--defda975-445b-480d-917c-eb9748ca6f1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.161.233.190']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e5c8eab-c080-49df-b98e-0ff2076dce45", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.86.65']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43876cd8-b97d-48a9-9320-5935326f25b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.1.211']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12433258-e181-499b-9a31-62ba7ef435fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.131.148']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da5d45f-0149-407e-89e4-b926cb9c32d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.242.189']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d89dc6bd-af69-46b0-8c06-55cfebca8325", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.18']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d5fe841-903f-4363-b05c-cc61c9bb97cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.161']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b00f9057-b904-4487-93d4-57ee2ac3657f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.196.178']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d28254c3-3e6b-4086-9708-4e08d9b2aad2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.196']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b44d1573-1484-46bc-a496-45865003f635", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.230']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1e34648-569b-4054-9ece-07544debfaff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.72']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7645da11-69b5-4cf5-91c0-963a58346d76", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.247']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae60a890-2055-4abc-8c82-fda639dee084", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.132.93']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ff4f147-ffea-4648-830c-7737b8b9916e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.230']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f34a0cf4-ddb1-4196-b740-80be6a47af7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.65']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b0e8d8e-95f8-4991-a710-a4ca3983f550", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.149']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8371542-19a8-4434-9122-241b091160ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.232']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--025a55f8-662f-4789-9f8d-622eb08d8f47", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.175.108']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0f22dc-5f2f-49e6-a3f9-bdbbb3d6f108", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.175.68']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0efa5431-e997-4038-afb3-ab20f6e35ce0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.175.76']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a39b54b-098d-4836-ba10-95acdeed4f55", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.175.83']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064ed2ee-8386-4d06-b167-2227e7279bbf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.135']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4659c312-101c-4d09-8789-4e7b9f127027", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.243']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9cd1ba6-79e0-47d4-9596-39aac69c936e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.177.180']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64ec72a-e6a5-4c9e-a09a-73909247d7d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.177.244']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80312726-c105-4b12-9d1f-78534b9f7026", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.178.129']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8402905-8919-4c53-859f-c8140600c537", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.142']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5043b1-2c2b-4a39-b537-27b69864217c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.152']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d944c95d-41d7-4f92-adbc-dd44f6e7f348", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.208']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d4b2247-7ebe-416b-9826-ffe528a852ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.33']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea6514e8-c313-46e6-8a33-3622fe530649", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.94']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b2e02af-3991-40d0-b8d6-08999ec2cdb0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.197']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f4893b-692b-463c-a7af-2728da70a84b", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.115.26.203']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8611d885-335a-4784-bcc9-c02030591955", "relationship_type": "indicates", "source_ref": "indicator--07f4893b-692b-463c-a7af-2728da70a84b", "target_ref": "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec8a0065-baf5-4728-b063-fbba4762e000", "relationship_type": "indicates", "source_ref": "indicator--07f4893b-692b-463c-a7af-2728da70a84b", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4815325a-9b3c-4504-b4ca-9ebdd39a1e41", "relationship_type": "indicates", "source_ref": "indicator--07f4893b-692b-463c-a7af-2728da70a84b", "target_ref": "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5578a61a-712b-4ad3-a6b1-ec45f56a7ee7", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.131.195.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3abdeff4-e9cf-4f33-97f4-614454536be6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.22']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11b4d9ad-27f2-4038-b41a-735d725d6853", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.24']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b4ce19b4-7870-4aa1-801f-ea650a125227", "relationship_type": "indicates", "source_ref": "indicator--11b4d9ad-27f2-4038-b41a-735d725d6853", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7cfe97d7-738e-4ca1-b90c-011df25f1e66", "relationship_type": "indicates", "source_ref": "indicator--11b4d9ad-27f2-4038-b41a-735d725d6853", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81a3078b-027e-4a7b-9bd6-46ec0a93ca93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.27']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd5541a-a436-4973-b3b3-7c0eb86eeed7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.29']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--133fca3b-7b10-480d-a5d5-20e851f1bf73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.139.104.164']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9f813af-72e0-49b5-8cd6-b905668ec20e", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.146.55.82']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f88eafd-59c8-4b4a-9af0-0d49f1da01cd", "name": "Malicious Host", "description": "Observed: WEB activity. Web exploits: aws-credentials. Sensors: cfglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.120']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:revproxy", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f8405406-7227-4720-b463-65b0ba28bee2", "relationship_type": "indicates", "source_ref": "indicator--2f88eafd-59c8-4b4a-9af0-0d49f1da01cd", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc01f9f0-d096-4a7e-866e-53013addfeda", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49d71a9-54d4-43b5-bfbe-7028d00fff2d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d87e9ff-e4ab-4969-becd-b9aebff34f00", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f373dd2f-22d2-4c5a-8cbc-8946d5af1aef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f55281d1-aa3a-427d-9083-99f359f87063", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.21']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf1edf7-3ef0-4a2e-b17c-f73b9fe67c9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.40']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d596d539-1dc1-4877-acbd-73b350da542a", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.9.11']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d0ca396-8243-4fc4-af14-2f4758ecd183", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.150.174.97']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c944c276-d46c-4194-b21b-2c2fbedae370", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.152.14.125']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c061882-08d9-451c-b76b-e7ce041ea82d", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.43']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79938c0b-6c56-4d7b-b886-4355abb38a63", "relationship_type": "indicates", "source_ref": "indicator--1c061882-08d9-451c-b76b-e7ce041ea82d", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--013de45d-8d0b-4565-b5cf-f7e5e07a107c", "relationship_type": "indicates", "source_ref": "indicator--1c061882-08d9-451c-b76b-e7ce041ea82d", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--259c8d61-30ce-4814-871f-e74f807d88e6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.162']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a9301d9-8c67-46f1-8f7e-36a5d463d4dc", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.195.250.117']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e42c0833-3e3e-446a-b649-336dadcec008", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.45.237.97']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48cdf73d-093e-4fff-8be5-aff1820fa807", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.59.124.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92494ccc-96b7-4cff-a749-544c181e8865", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.70.12.102']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--130c3295-765c-49dc-91b1-17a6b8c9f28c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.78.194.242']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9391bb83-23b1-480c-a916-debc6108e1f4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.78.204.246']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dec3442-0994-44bb-9d99-4b2e943fe31e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.182.231']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8ec146f-ee54-4491-9b84-304d44fbcbab", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.172.202.239']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93708104-457f-4080-b15e-a3ccc2c1b52c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.190.115']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd3673dc-0c33-406f-96f2-fb56bf0402eb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.228.211']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--093b6e9b-7855-4215-badf-7c5df30a73ab", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.48.30']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb24934b-d945-4d17-a5bf-f0dc92381a02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.79.13.186']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d87fda3b-5935-4951-af22-a694ebfc9a14", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.17.206']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1332d4-af1a-4f3a-ae3a-912dd5ca40dc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.237.195']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f36f3bd5-b3d6-4b87-9588-f14ccd47b4bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.166.228']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4b1f804-2b68-4735-888c-bb0ae129e01d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.181.211.74']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fdb4780-7574-4d1b-b7a5-9c4f4c44fba1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.107.1.72']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cec85ba-e107-45b9-be06-14b65d79a769", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.8.102.111']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97324bf2-454f-49b5-9cce-5cba9ab8fe5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.137']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f0bad9-faea-4543-b874-8a3828a4c80c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.6']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c983c925-f876-4039-ad07-78bfc5836f8c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.78']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a6edc8-1711-49f0-ae02-0895010fa00c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.123.140']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4957178e-5b98-4c9b-ace0-4e440e1eaf23", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.163.65']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a2b085e-8854-4007-8d1c-736757cb9f63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.139']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eb50f37-cf73-416e-a345-76b73bc98f7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.159']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9a596b0-5a6a-41a1-ba84-c827ca045409", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.16']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34eca7ab-a6bf-4b45-abd4-6905ad4e61bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.163']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ef25912-a6ab-4d35-9183-0ab2d839b69a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.166']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--036af524-552b-47c7-8b4b-41fad24f3ec5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.176']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1b06551-3a3c-488d-a72e-7357368c0f08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.180']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--709436df-25f5-470f-b6cf-c18643f83839", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.181']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2dfe451-a5b9-4919-981e-4fb31cfafad3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.195']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceaeeeed-0051-4217-9c10-2bfe3d523ad2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.196']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--005142ac-0fd2-4693-93bf-5725a832fc77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.205']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c25a4627-e398-4ba1-8a65-3791b949de6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.206']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0674320d-40e4-4cca-a3ca-7f4c1fcd6fcf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.212']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--552d5fa9-6104-4abd-abdc-4db83607c2b3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.216']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf5ac48b-a654-420a-a410-ac7fbd69adc3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.232']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a1375d-7e39-4af5-9dc9-dd826153331f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.233']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9120f6ff-0901-48e0-a682-bf6db8f7c7b3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.25']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef6bd01f-83cc-490c-bcd1-4b8418ac7af5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.230.100.152']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--672e1038-d300-4238-aed2-a2656e2d0e6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.131.131.18']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14811951-4767-4d55-8381-e2e5cb3c44e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.0.61']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da04a8b1-349b-4a01-829c-b1d593e3da94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.103.216.204']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--836a83bf-b6a0-427e-b63a-a7389a53f5f2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.58.107.196']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c076da77-79d7-405c-b638-440e2ac2880b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.117']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5352be36-8197-49dc-94cc-21d1d32bed92", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.242']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b40e1ab-c05f-4510-8597-1afa0343a46b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.253']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a823bc9a-07a0-4ab2-b4a9-8801e47815d9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.8.171']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69fcaad3-e1f3-4cbd-991a-8c94d4a2a27b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.160']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5e87940-38e0-4279-99a2-036f3022376a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.90']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e29c2ddb-aaf6-4317-89fc-403b0a69238d", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.139']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--245dda5f-0f0d-4cc0-b8a0-ccb4c4d6c4d1", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.148']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab9fc9d-0e77-406d-b202-9c9720858759", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.176']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18df18d-3897-4bc2-bcb9-877dacf22561", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.78']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82ac4b5b-8db4-422f-841e-915f9519a21b", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.90']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7b59fd3-1d66-45e1-aab6-1caff905c426", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.24']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4131213-298d-4779-b83e-73b85b35dcfd", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.215']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--622378e7-5b3a-4bf0-a64f-28450b50ba6d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.67.113.17']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5bc4566-6e8a-4fa9-9f60-63b4bf1a48cd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.49.246.176']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23742dff-4edb-408e-b964-7fb548aa9682", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '70.153.148.150']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--809e1a17-ca72-44a5-ae9c-fd9878944dd9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.226.76.114']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99d923ea-0d79-4950-b3fd-144717af7517", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.240.125.133']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59b6b8d2-74c6-4e8e-b816-7dd4f294d606", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.255.26.187']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73782cba-d0d2-4b6e-8693-b97b5fac4a85", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.255.52.237']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3531b9c1-c25e-403e-8888-e37b124acf5d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.128.235.233']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7168fd93-b3cf-4de7-bd47-5c90e5c57daf", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.50.98.193']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8bbf37f-dfc1-4661-88f9-580b7eb69a81", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.230.34']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69cb7ec-d5eb-41ba-b86a-e1e54ea3482a", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.139']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34fe23fa-6de6-4e0d-a567-8a0ae25f195d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.242.35']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f72336f5-509e-4ac4-9ae5-976ce6eb78e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.243.192']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--266a040e-2a8b-4ff7-8743-c5835b135209", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.36']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ebd8e03-7a19-4eca-a975-0bcb06eaaf6f", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.176.1.64']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e20d5dd-264a-4aac-9f5c-9bf9b5aea08d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.37.28.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b0bd33e-aad3-4d8c-a14d-227e6eab9127", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.52.26.13']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7eb37ac-5235-4f9c-8cc7-3d9578f76d0e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.20']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d1071e5-5b17-475d-a4cf-e735ffe3cfee", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.207']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee3c973-1cd9-44ed-8c3a-38178aca05f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.25.4.101']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db967974-b1e9-4a29-930a-9c6efa130542", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.217.145.188']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f70d811e-1b87-4d81-8094-beb5daa803b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.107.244']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6feb9706-b5db-4faa-9d01-2342dffbce9c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.220.7']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14eddfd2-3322-4a1f-b01a-bf4e3aee4e3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.235.84.203']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bce1f4e-a79b-459e-919d-cd5eb8e2c083", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.179']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c19b751f-6311-49f6-aa65-57561ebb7345", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.55']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.211']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--06ca3903-fc12-4358-8c31-a3aaf93c166e", "relationship_type": "indicates", "source_ref": "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2f5d1a7-7882-4383-ad54-54ae6b5b7317", "relationship_type": "indicates", "source_ref": "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "target_ref": "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e9a89faf-6bf0-4713-bd01-4d2ecdc3e249", "relationship_type": "indicates", "source_ref": "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d5a1abb6-a789-49ab-9a81-164e5ea3b950", "relationship_type": "indicates", "source_ref": "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a07723b4-1c70-427e-8f88-2e0340af9745", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.171.72.135']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086438b6-d127-4337-a89d-d33851c338bc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.37.162.70']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc5d85ed-cfb3-4fd1-a6bd-8258ffa4d6b5", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.116']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42861668-2925-496e-948e-742d7ab0a73d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.118']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a75ac03-04f1-4a1c-b9ca-3e74b03ebd3c", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.126']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--849043a9-5033-466e-b85b-36adcf4931b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.217.213.120']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b059509-9800-4b02-be9e-ce898ab97c30", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.154']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28cc44a1-3732-4683-b9fd-a2e6a89e578e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.212']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4774f3da-89be-4aee-bdb4-11ea0fcc33c0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.38']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2605deed-8475-426d-ac4d-1cca60f270c8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.165.104.58']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d73c69fa-8f52-425f-a9c8-2d382d89396a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.204.70.106']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85302234-f186-4b7d-b157-47571ba60ddb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8f7572c-ac71-4247-80f7-89bda2a88abc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f40807d-e80b-4bed-ac61-eb7c93aedfce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2331d1-f592-40a5-b96f-83688ffb01a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e99cc168-d5e2-4948-ba1f-8c44af5b4b08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4618ea5-f1c9-4c8f-9f28-0475aaab1395", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a89a4f-a23c-4b2e-b826-524539787296", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb5f9f4-f4ca-4fdc-b6df-7bdebf2cff69", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41652863-61ee-489f-996f-4f8325d1695b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d064ef5b-11eb-456e-8450-e08c4cb49080", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bba9020-8564-40dc-bef8-9075a379b6e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49587720-b528-4af7-b97f-3c73806a0346", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b11bf8a7-9be6-4aac-bc6e-1677be0a3e96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c574f9c-99b2-4b2c-96b2-bf2d28423016", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2133e271-50de-4c73-8f88-727171e27592", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80396a0f-635e-4e51-a864-512923690770", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdefb32c-5db2-4e93-a054-3deb9a3c6349", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ab88b8b-905c-45f5-80ad-530b5c41459f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea963865-d087-40ec-b987-f1ed7f5b2c2f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73933292-556c-4878-b144-260ddaef10e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88dfd3a2-ba21-42b6-baf1-48dccaf473ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.55']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1b60dc-8136-4f8d-b943-1edadef50ace", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.57']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--066173bc-343b-497a-b1d1-dd3b10f6d8b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.58']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1b7bab9-2035-4b9c-a523-2f300aad6409", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.59']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799ac2d9-a234-4a76-ab96-6da75db90fb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.60']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--307029d0-e4ae-4e9c-b6a6-5eb7790e44ff", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.151.82']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--beceb0d0-cd6e-4656-87af-8f3dd3f25cde", "relationship_type": "indicates", "source_ref": "indicator--307029d0-e4ae-4e9c-b6a6-5eb7790e44ff", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2e3b178-ed52-49a0-a22b-e747811a56ab", "relationship_type": "indicates", "source_ref": "indicator--307029d0-e4ae-4e9c-b6a6-5eb7790e44ff", "target_ref": "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fdc72c7-5edb-45ca-925b-41f75df507d0", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.225.157']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f7d0aa7-e6fd-48cf-a06f-9d5d3031088f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.241.35']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73cfbe05-7714-459a-8d6c-fe4629186f5f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.40.35']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17f94867-eac0-4489-a9ac-d99f5f6dceef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.40.36']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab19f7f3-fb65-4a62-b03b-505fcf22fd15", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.72']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf90bc7b-988d-4911-af78-0fbcccc026ee", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.127.52']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11873f3-b08f-4ffb-8050-93308c30290e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.50']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0941a7eb-fbe7-4dc7-8fbc-5c3401764f6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.209.11']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f13062ba-fa61-426f-ac3a-a2658a8254d5", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.156']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e74ee19-058c-4d26-a0d3-f8fb07a0901b", "relationship_type": "indicates", "source_ref": "indicator--f13062ba-fa61-426f-ac3a-a2658a8254d5", "target_ref": "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ebddc426-d36c-4873-8542-d8f76d3a4caf", "relationship_type": "indicates", "source_ref": "indicator--f13062ba-fa61-426f-ac3a-a2658a8254d5", "target_ref": "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cfbceb0-009c-4d76-be9c-45f0bd2950e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.159.230.84']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761ca6de-f976-40ee-93b7-59301ecec7d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.207.110.110']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac8987dc-701c-4f40-b607-59451cd899a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.214']", "pattern_type": "stix", "valid_from": "2026-09-17T00:00:00.000Z", "valid_until": "2026-10-17T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1326ff94-2b90-477a-a439-7da834e7ccf3", "sighting_of_ref": "indicator--19faabce-04ed-48a6-9e18-38fadfb26432", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f9a138d-70ec-48b4-b666-8cae35ca8b6f", "sighting_of_ref": "indicator--7cd29972-3f39-47bb-a921-839d6ae44e2b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a46b896-b3f0-49ed-b70e-dacf872f705e", "sighting_of_ref": "indicator--472ea49b-6a64-45d0-b25f-a3f3f35079dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06e72f86-3205-4d6a-8353-8f1e2dd3926b", "sighting_of_ref": "indicator--adc4f450-2d53-491e-82f1-22caf0b6131a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4357c0fd-50bf-4326-aa2c-3ff2c58fb34c", "sighting_of_ref": "indicator--bdf8e20e-ff92-4f8e-887c-87ce314629b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8adcb386-5e1d-4a12-a907-dcc90901a2c6", "sighting_of_ref": "indicator--6a1493f6-a16d-4fde-8cf0-819e4709e238", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5172f5cb-8cc8-4cfb-bb24-61f666d02212", "sighting_of_ref": "indicator--cacfbe2a-6af8-43ef-8cf6-696ec151880c", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513e604c-6222-4cb7-a6bb-64b4af577a87", "sighting_of_ref": "indicator--8b1b47d1-296f-4f49-b9bc-710e76cb5c39", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7dea7d4-6b35-4a5e-aff8-4d22f2858bb4", "sighting_of_ref": "indicator--5d1595f7-cb9e-47bd-81be-4417ab123494", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75000661-80a9-4f14-b294-e0ce027e45ca", "sighting_of_ref": "indicator--76456028-641a-49c8-8fdf-a4c72622c9f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1897e5b6-2b38-408e-9f6c-fb8241fccdc4", "sighting_of_ref": "indicator--7cda04ce-7a62-4f6e-9da8-b2cb4bcd335b", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ab3e8c5-fe63-4af5-b068-b0c56ac07fc2", "sighting_of_ref": "indicator--7a9bf9dd-1fd1-4522-a6ce-568499ee9e3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fb361c0-2cff-48f0-9bbe-6caf2330c9b5", "sighting_of_ref": "indicator--2dd65c08-7370-4545-b762-f98fff462b94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1266480b-6a52-4e6d-a126-a423bcf8f7e0", "sighting_of_ref": "indicator--9b58b7c2-94d6-486c-8cde-ba3329c7f93b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39772ef4-1e13-47ad-8d68-49c689e22d5c", "sighting_of_ref": "indicator--e5a5e3ec-9b2c-4231-b6d4-bad5d1ed623e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99336668-02cd-427a-81e1-3c5c21067391", "sighting_of_ref": "indicator--2af10dd8-aa24-464f-9431-04a13c15dcc4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c239693-3fa8-4e8e-838a-6113a458a122", "sighting_of_ref": "indicator--ae634394-0f4b-404e-9261-c2d3445d4551", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ecf9c1-095d-4794-90c6-c9b437e52296", "sighting_of_ref": "indicator--90f6022a-9980-4b2a-a5c2-dec79e9a450c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81de6cce-773f-4df2-9d18-5a9be03dea6b", "sighting_of_ref": "indicator--336a57c1-35b4-494f-adc4-badce9c6134d", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26fe51f9-cf1f-4bb6-88bc-5703ba7b2a9e", "sighting_of_ref": "indicator--15135d32-7959-4709-8983-57cace22513d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff254bbc-c190-434f-b447-9a8ab8ce309d", "sighting_of_ref": "indicator--88bbb85c-af9b-4608-ac74-3696172130a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc04d4e-09cb-4147-8e15-a6d31bee4d40", "sighting_of_ref": "indicator--12c45506-7f97-4da9-a519-6f1f40b0dafd", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a637879f-5b13-4fb9-bed9-55872da91e77", "sighting_of_ref": "indicator--497bf7f9-7126-4196-8909-460314aa71ff", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c35903d-8448-4851-ba20-91dfa9bc5b47", "sighting_of_ref": "indicator--72a5f174-fb7f-4fb1-acab-bd9c3de80e12", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99aa66a5-6833-4395-a748-586fc996af92", "sighting_of_ref": "indicator--0cdd6a55-4449-4ed2-90f6-d5fc7cb6758e", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974001c2-8436-4dee-b3c8-afb2debf4446", "sighting_of_ref": "indicator--16c6838d-da5a-4285-bafb-6cf1b39c055d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a1ed74-8140-4f79-a25e-91e37f7d526f", "sighting_of_ref": "indicator--2776ffc5-ff34-4a5b-9d98-17c41f97bce9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c357aff0-fe93-4172-9c89-b5f60e005789", "sighting_of_ref": "indicator--3ee76488-5af3-4dba-8956-a53b62e05955", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762223bf-b645-434f-b14b-d2cc618b98ac", "sighting_of_ref": "indicator--5a31890f-930b-495f-b813-a816e1c6a587", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d31fc2-9933-42d7-8f73-d133f1b5bb8f", "sighting_of_ref": "indicator--6c293527-81d2-46eb-842f-e72f9f3bf379", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d39f861d-27ff-40ad-8a3d-e24cdb08f68e", "sighting_of_ref": "indicator--282a86ae-518f-4622-a5f1-bff8b818de89", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30fcf023-c728-41ea-9602-3d89bc6e97de", "sighting_of_ref": "indicator--6cf7353b-8342-4c01-97ec-bb9e7d4441ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95559117-5de3-4f4f-bf93-9249e352e686", "sighting_of_ref": "indicator--70c7d69c-f3bd-45bf-a303-8cac1e644ec2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f4e6511-f185-4620-ac10-b894e0bc79a7", "sighting_of_ref": "indicator--ba43be0a-abf6-438b-87ce-67cbd405e16d", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc0186b-1e8c-414b-881c-68f5106bc96f", "sighting_of_ref": "indicator--b4f3aa0f-6347-42dd-b152-fc3f83404b90", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af1383f-66d6-4bff-a383-0209dc1fef52", "sighting_of_ref": "indicator--e74ac4a4-74a6-4345-a2aa-5ff238aa7857", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af4bf1c8-1711-4fd9-b937-cb12454396ab", "sighting_of_ref": "indicator--8a7552de-3034-4161-aed9-d063910a7d33", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53ba60da-a0b4-40d6-8611-0ddc7ef6bcac", "sighting_of_ref": "indicator--6591c01d-30a5-43fa-a122-38f1037df446", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc2d09b-db3a-4de8-97ad-884436789366", "sighting_of_ref": "indicator--3a16f0a1-df21-41b8-aa7d-dbec1aefa33c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970e2f97-e2f1-45e2-af93-8990e476898e", "sighting_of_ref": "indicator--bcf3b49f-d7a0-48dd-a08c-25d8e48d9ed5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f5e187-058b-4b59-bb7f-fe79668daaae", "sighting_of_ref": "indicator--a5aa6b84-70fc-441a-8821-f5d06896bb63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0715c85a-5478-4f6a-ba36-3eff91c58540", "sighting_of_ref": "indicator--5b4b5830-2db8-4416-9fe0-0e6def22a8b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--533fb4ab-9963-4b82-8686-8f767466f159", "sighting_of_ref": "indicator--0d404e05-e6cc-429e-9a9d-dbe1d5b1a057", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a062315-dcee-4282-afa1-05e884733dfe", "sighting_of_ref": "indicator--a109460e-25bb-4c60-a51e-1f1a76fe9c21", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1182441f-e056-4d93-8fd2-cdbc590d7004", "sighting_of_ref": "indicator--c3eb424d-afaf-4b54-96fe-5817b287f63b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970eb175-5ada-42f1-a980-3ad3734eb097", "sighting_of_ref": "indicator--8beebc54-9868-43a2-9cbb-4c2efc065c40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a58916e9-c9e3-481c-a58f-3c3e7beaa41c", "sighting_of_ref": "indicator--544d85f2-8b26-4968-bd96-097bf5351570", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c199ad0-1c7c-4b72-98d3-b5f460c243e5", "sighting_of_ref": "indicator--227d65a8-d30b-4f97-be78-9222a91c5d33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa3ae9ca-42a4-4666-9c7c-fe74b1b37edd", "sighting_of_ref": "indicator--c12f09f6-d986-4ad0-9129-aeb790ca45bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50008b2b-93db-4fde-906f-0b4ee1f2c539", "sighting_of_ref": "indicator--9c82ca3f-b722-4831-91c9-9079f6cfe45f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e19ff85-2b19-4d69-99df-1df120285f3d", "sighting_of_ref": "indicator--f2b175e2-f9ea-49c4-bf5b-a35ebd921fce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cab63aa0-3767-48e7-99a7-bf294bcf908b", "sighting_of_ref": "indicator--29619ef5-8ad4-4976-a763-24682c71e79c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea8e552b-e37f-45c6-ac29-74ce6d864686", "sighting_of_ref": "indicator--647f72fb-73ca-4d9a-89d6-087487e3eb6e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09860124-7cd3-48af-a8ea-ad438c0c055b", "sighting_of_ref": "indicator--fa0274f0-5f5a-484d-8a25-2c14fb86de35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182edc32-ac84-49d1-bdf7-22ca85c6b601", "sighting_of_ref": "indicator--ec9a6589-4671-4ee3-8bdc-778bdae7a785", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c9e58e2-43a8-41db-9da5-96c993b6fe50", "sighting_of_ref": "indicator--9cb8f16a-43dd-4022-86f7-b3541a7a2e43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405cb87c-bcd3-4115-a87d-77c191472ad4", "sighting_of_ref": "indicator--d0000a8a-adbf-4b42-bd3a-4278efa6be4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1460195a-2459-4d9b-9250-e7fce77955c4", "sighting_of_ref": "indicator--b097576d-0293-43a6-86fd-0a6adc29696b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44368016-609e-4fc9-9756-7dd4c7666249", "sighting_of_ref": "indicator--520b1cf4-a314-4268-b09f-cc835b8bf0e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd0a6113-c639-4d74-a426-526f11e5d507", "sighting_of_ref": "indicator--df77f4e1-f94d-4ec2-9dc6-b4c8d12e5337", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e93d8c2-ad50-433f-a530-0a67832681c7", "sighting_of_ref": "indicator--533bdeef-1fd7-4079-8b3e-bec632882bcb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a08c140e-c395-4769-8d15-f7c8ed60abb2", "sighting_of_ref": "indicator--b647e4dd-55d0-4d7a-9e32-25c02a765806", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39a00b0f-ffbe-40ad-8c37-f1de0e112bd6", "sighting_of_ref": "indicator--b5b136b9-837b-4ef2-9b30-828c4f5d9fd9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c217436c-cca1-43d2-aa3b-5108cb452c8d", "sighting_of_ref": "indicator--0efc67af-42e4-4f89-9410-a2e9b4ef6dbd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78b78dfd-4f51-4266-9f2f-0afb3a07ef3d", "sighting_of_ref": "indicator--a1a017d6-12fe-4b65-9268-458a6abcbe78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--decbf31f-9f39-4686-af17-1137b2a30928", "sighting_of_ref": "indicator--ed5c15b0-40ad-4d7f-902e-df12ba0df78d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e82aaf6-cae7-44a5-8f4a-ec7697366670", "sighting_of_ref": "indicator--a382175b-8267-4978-81e5-1d33eab703f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--953488ae-4b8f-47c8-b7b2-5a39a7fd5633", "sighting_of_ref": "indicator--a83f753b-4b83-4c10-8428-5edda9137d2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0872d494-8083-4bca-8a4c-9163b39e74d0", "sighting_of_ref": "indicator--0029a5f5-a032-4fda-8ee4-e1681d65c0ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6bb8a1d-ea9d-4982-a16e-99e853821592", "sighting_of_ref": "indicator--4ed1b78c-d95d-4d7b-a7c4-145257708e32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51568c35-4ebd-4381-ad93-400d9720bd0f", "sighting_of_ref": "indicator--b1207691-1c82-49a1-bf75-73e8190d0f4a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94b2948c-55c9-4708-946d-b2d3dc03bc4a", "sighting_of_ref": "indicator--178bc5d3-7494-4dba-91c0-8552ec49a684", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c22267f7-c4fa-42f5-8330-0f94642667b1", "sighting_of_ref": "indicator--57c78c28-d7b4-471b-bc7f-81a3073d9118", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af83b37-d5a3-432f-9d77-b171d00dc66a", "sighting_of_ref": "indicator--8f81b0f8-aaeb-4fa3-aaf4-65e4936907b3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b0907bd-0443-413c-96e9-33440864c43d", "sighting_of_ref": "indicator--056ebd77-6835-45b4-956a-d8cf80fbb8e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b07b6672-e979-4381-9e9d-5e9197d4d373", "sighting_of_ref": "indicator--d32a40b8-71eb-4702-a869-c1f017ed8504", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6608dcac-4b9f-4459-bd28-17649d43b6cf", "sighting_of_ref": "indicator--8315eade-07af-4049-82c3-6b4af25debf7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6252c0cb-b437-4d8c-9786-09976751fc6c", "sighting_of_ref": "indicator--aae72968-5e6d-4c81-85bb-0898cfc1fd73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6334aad1-0343-437d-acde-a2d87c4c5522", "sighting_of_ref": "indicator--f8edfe6f-2469-4449-a26c-567716384fdd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--450fda13-36e6-4a06-afb0-d33bad7de46d", "sighting_of_ref": "indicator--e863beb2-d6a0-4506-a3d9-548bd1db466f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79a5c6e7-85fd-4d7a-be06-3b2f69e4e711", "sighting_of_ref": "indicator--463a455a-194d-4a83-ad98-5b27080d4f3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--340fe4fb-bdad-4970-8c73-6afb1b6ee21e", "sighting_of_ref": "indicator--aced55be-7344-4b94-9c32-0bc14c636c79", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19bf0895-77a2-45d6-8498-0aabe573b46f", "sighting_of_ref": "indicator--ab2c029b-a94d-4580-a1ec-67587e051bee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--505e5384-bd40-4c36-8b5b-fccc0cdab00f", "sighting_of_ref": "indicator--be7e0dd0-d3b5-48d5-95e9-c40202618c57", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcde6923-bd05-41c9-aa47-98ad6ddddbfb", "sighting_of_ref": "indicator--9a413764-c150-4d6f-9774-434b3e104375", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25fa5f51-8464-4428-8812-acee86900d81", "sighting_of_ref": "indicator--53664090-a91f-4911-853f-c7d36ea75ca9", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61e9e1b5-56f5-4fec-ac5d-d9af571cebd9", "sighting_of_ref": "indicator--b649ee76-c85f-461e-b09d-969f82eaa77f", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae24ec4-e22a-4785-bd89-488d67b2d17a", "sighting_of_ref": "indicator--ec35d03f-eb96-4afe-921d-4a1c69d86b5d", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa622f6-6d4a-4ae8-a305-b14ab1650574", "sighting_of_ref": "indicator--49f940c2-0f2e-4f07-9adc-e1d50951cb6d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c571dd3e-b1ac-48fc-8994-f3898186002c", "sighting_of_ref": "indicator--56018de6-3a4f-4674-90fe-dca741cc37e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006a286a-6c47-4c9c-ba97-043162edfd8f", "sighting_of_ref": "indicator--17c7baf6-b3ef-4f42-b6f2-63fd87da7ccb", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7b7985-484e-4044-8a8a-253cf4962b59", "sighting_of_ref": "indicator--214dfb07-63c3-42ca-8a34-d6564df432c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fbfcd7b-6bbf-4fd6-8e09-6606c6258cf6", "sighting_of_ref": "indicator--6bced88f-699f-4094-9ea4-90eeaa1f2ff3", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fddfc11-246c-4cb0-b1ef-27c9f00ad0e7", "sighting_of_ref": "indicator--c1de2464-71a1-4ee7-9329-f12ef84a0813", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1661fa21-0903-40f5-951f-b92856f6daa0", "sighting_of_ref": "indicator--5661c5fa-f9aa-4d59-bb8c-56308fa9b9c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12a2c8fd-4498-49e8-b2c5-576e22c7be98", "sighting_of_ref": "indicator--3b6fd9e4-fb5f-469a-ba7a-bc366fd05b9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c1012a-498f-45c9-bc07-ee486c4b5e84", "sighting_of_ref": "indicator--64f4e205-d863-423e-9824-48bc42590551", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--432edab9-8c84-45b6-8fde-55d5d8e54081", "sighting_of_ref": "indicator--9a496dad-7c71-4421-b314-71e548abee1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2848a7fc-e2df-49ff-9c5d-8d9b469a0116", "sighting_of_ref": "indicator--d74f2c50-0119-44ef-8530-e4398beee589", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269c9d93-0040-4bdd-a3e8-5e8825e33174", "sighting_of_ref": "indicator--cebfbdae-48db-4535-bfa1-8f246b03fd39", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f875c25d-eb98-4b74-a8db-36e21f50f13c", "sighting_of_ref": "indicator--35e3d245-9da6-4f4a-9c72-ab5f01b15bef", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aee7825-15b9-46ca-90c5-c277cc57e968", "sighting_of_ref": "indicator--1a62cb1c-d4b0-4a4a-97f6-9e88df4d5123", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--665a9eb7-e621-4a49-abf0-d2b890944762", "sighting_of_ref": "indicator--db1c23e3-0f7e-4726-94c0-73aac84f2293", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19d7bd5c-e293-451c-858c-bc375f50e008", "sighting_of_ref": "indicator--68cd63a4-fa97-4345-a3e0-9fccf8eece8d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae6a8f7-d8f7-4c83-b584-765d274f4576", "sighting_of_ref": "indicator--accd775e-07de-4c81-93ae-a308f7b1c39d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c0a648e-fc74-46ab-8f15-f9e0d13963f3", "sighting_of_ref": "indicator--eda3f707-e5fc-4a04-98be-8bbdc46718b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed7afe79-6f41-4a10-9234-f5b654226199", "sighting_of_ref": "indicator--a5a061d4-c82e-4f5c-b485-f08efb885f3d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28cd88ab-64ad-4818-ad64-464d26588550", "sighting_of_ref": "indicator--0a015601-bbd5-45bd-8085-aee09f2dcb53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1072fdaf-7162-46ef-9536-b70504dc9962", "sighting_of_ref": "indicator--2f501970-9e56-4438-9037-5c916b82c29c", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3004fa-2f15-4f64-9977-11505943175a", "sighting_of_ref": "indicator--79a8c1c5-3378-4d28-a1bd-3c30d8c09961", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bb00d13-2deb-4035-b972-b463343b5691", "sighting_of_ref": "indicator--25623b70-28eb-4857-9a77-64ecd5360866", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef420352-0fb8-4f0c-ba1e-0e451f394c6d", "sighting_of_ref": "indicator--d77b6bd1-b204-4ff4-83b4-283619596a19", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27c7f78-ac8d-4cc9-8597-b084ea98e7f2", "sighting_of_ref": "indicator--81c4a9b7-e554-438e-ba9f-ff10d3898691", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceee1d4a-b866-4b29-acba-46b4100d56f1", "sighting_of_ref": "indicator--5ccf894f-0c15-4dc2-9a5d-2b6fa126a40f", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03218468-a657-446a-b961-46bd17a147c5", "sighting_of_ref": "indicator--3eb62f56-ac54-448f-970a-0b0421633c49", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f148dc35-98c3-4ff6-afad-d147a71e19ac", "sighting_of_ref": "indicator--1340f61b-0267-4d24-83b0-5482071de6d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa64cb1-b807-4a12-b5e2-803953d2b998", "sighting_of_ref": "indicator--1d63b962-3980-4ecf-a2bb-e6a606df780d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13c4cdae-ccae-4de2-89aa-4ec8eca443dc", "sighting_of_ref": "indicator--2c65271f-1de6-4d91-b8f2-dada0bab4d11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5101d8b7-76e1-4ea1-ad62-6cad485736ea", "sighting_of_ref": "indicator--582847fe-87d5-42ed-abfd-ccbfa25d558e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd9d71d2-a7ab-4b74-9ff5-9e93deef2cf9", "sighting_of_ref": "indicator--cc72324b-bae6-4ef7-b27f-035ac037d60e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0cf73ed-c073-4bec-a504-d1a999a2432c", "sighting_of_ref": "indicator--5ad8de70-3fa4-40c4-9feb-fcf797005737", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75e0c8e-a0ff-4df9-80d5-7a36a872abe6", "sighting_of_ref": "indicator--4b392638-3cfd-4e05-bb5b-9dc165e333bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0bcef07-f348-4ac0-a6f4-aefd5a0a8674", "sighting_of_ref": "indicator--b540a048-a1c1-4e90-b8b2-6798df0cf6a8", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7638d3a7-1cba-4dda-8888-746e8dc9776d", "sighting_of_ref": "indicator--c008e241-dee6-443a-9b36-93808164551b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7b22961-6d47-49ae-a6fe-64c004eb3244", "sighting_of_ref": "indicator--dc2fe091-53ac-4084-9309-f1736364bb0d", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcca6652-9dd0-48f9-b1e2-2fe12e854d8c", "sighting_of_ref": "indicator--e8d3296d-6835-4306-b009-fb5ef88f80d9", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc4228c-ea3b-4cf8-9bb4-7bbff5d14b94", "sighting_of_ref": "indicator--972e43db-7feb-4014-b199-37276970197f", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc317f6-fe23-4e7f-be0e-66d593cd4b8c", "sighting_of_ref": "indicator--6fc09206-359f-4b39-9475-f728af1dfa5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd92966a-5975-4f96-b78d-7c62a626b5dd", "sighting_of_ref": "indicator--56542c43-349d-4f2d-91b4-286265418f48", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--906670aa-34aa-4e88-9411-3d759b95d156", "sighting_of_ref": "indicator--2cd8f10c-85e1-4a0e-ab4d-d1529517a35b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fd4684-be5f-4969-b3d2-86aa123404ff", "sighting_of_ref": "indicator--e0a00155-17b5-4466-943e-dc05772862f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79941551-2fd0-440d-b048-c55aaf64f909", "sighting_of_ref": "indicator--6a06fc11-094c-4a82-8678-80e3cd927007", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a14830-ad5a-49fd-91c4-292baab9f3bc", "sighting_of_ref": "indicator--45ef1600-098b-438c-ad20-0b276f9957bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0514b88a-5a12-4d22-9ac1-3459a41ba358", "sighting_of_ref": "indicator--4b310c58-fc78-4f84-90f5-ed00f67c7bae", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f0cc735-240f-4dc7-8b38-edadf22e419e", "sighting_of_ref": "indicator--5b91bb97-34da-436c-90ab-f53bd8dded83", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ef2eb0c-63db-4781-b9c9-bfe0cceb6cdb", "sighting_of_ref": "indicator--8a747595-b740-424c-9892-77eb1ac8d727", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163e9477-47a3-4175-b901-2ea7d0774342", "sighting_of_ref": "indicator--18c2d517-64b4-4652-a94e-fe03ce3d2cd6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6f6d765-af0c-4021-8227-ef35aa6939b1", "sighting_of_ref": "indicator--5154a340-2eee-4fdd-bbce-45820e63cc56", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c7b83a-64d8-4fed-93f1-a9bcfe4af2fd", "sighting_of_ref": "indicator--0a2120b6-4411-4080-ab31-95790bcc6540", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f026d8-af99-4b1d-a158-6528ed8a7a2a", "sighting_of_ref": "indicator--1dc3bd29-4fe9-4b99-8dfe-4103f8de82b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24a22a2c-a4c1-433d-866c-b41d086e2446", "sighting_of_ref": "indicator--aa3013fd-a4f0-4a48-a9ac-9fc2adaf97dd", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ee83e3-c50a-4596-aab8-41352713b911", "sighting_of_ref": "indicator--59aa0425-f69a-47a1-86d8-35305df9f541", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec816c96-4a63-4618-aa82-b34b7e3ec848", "sighting_of_ref": "indicator--d1ccaa56-9f2f-467f-86c7-742916645dbf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8591c78d-7b00-4847-9fd8-86f8ecb2de62", "sighting_of_ref": "indicator--ae5575bb-9c22-4f7e-934f-e344717f5ab4", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab9b7cc-4e4d-47ee-87d3-b76a9789317b", "sighting_of_ref": "indicator--1461cc77-87b8-4063-8120-c02f052d3404", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12167357-bb73-4b2f-861a-82b7052534c1", "sighting_of_ref": "indicator--0d6c643a-a87d-4469-ad84-f85e72a6c032", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04bb695-e517-44c9-a3aa-6a7604bceed0", "sighting_of_ref": "indicator--238eceb4-a047-4ca5-ba06-1b494bf7a077", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f921016-8915-4f4e-bde6-650150df1321", "sighting_of_ref": "indicator--07821fe4-a5c1-453e-8ea2-7347fd7d7656", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3031e13-09f2-4711-81df-e4a14ae96ef6", "sighting_of_ref": "indicator--1609e935-8673-4ccb-94a3-79aa45c8ec1b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80da9ea-60d7-4564-93c6-da7df0c23c1b", "sighting_of_ref": "indicator--5a026d7f-fbb7-4fd9-aa03-4e256ccd43ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--774e6dcb-cd26-4bde-a087-eb5b71b0b61d", "sighting_of_ref": "indicator--0e86c609-b519-48d0-8e50-68155c9841f1", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b405ff0a-5360-437e-82ec-faf363e1db42", "sighting_of_ref": "indicator--cb54e829-0c66-40b6-aca2-4286acf5aaf8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b8f0ca7-86d1-4629-b625-0fd7addb9e7b", "sighting_of_ref": "indicator--617a9309-fd4d-4100-a761-9d275acffb32", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db382bcf-2be6-439b-b3ec-041f68000e79", "sighting_of_ref": "indicator--e0daa716-06ef-4e09-9f2b-d2eaa92cc5a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab05f399-16f4-4212-90b8-1ae27b56d10c", "sighting_of_ref": "indicator--8f11fe54-cc34-4346-83d9-20d973de2e8a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c033f11-1887-4d82-a9a2-91429186f77a", "sighting_of_ref": "indicator--be6726a0-260e-4690-8836-11deab63d27f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81b0c8a-d9a3-42e2-93f5-a5d2e879ddd7", "sighting_of_ref": "indicator--ff9ce763-ccc9-4f19-8e4e-0f74ba854e3a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52373857-f115-4b58-a3c8-627616a8f87f", "sighting_of_ref": "indicator--966ac8a2-0028-46cb-b86d-78fe5af421cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b115881-5e2c-44b6-9f91-c14c9757ddcb", "sighting_of_ref": "indicator--12fc1576-c5e3-4eb7-9800-7799c43139d8", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2371117a-18f1-4097-a19e-baa2566c7b3d", "sighting_of_ref": "indicator--fc423e3e-96b9-4457-bc1a-92cf38e80e2d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f7a20ab-eea4-4d7c-b69a-1445bc61d62c", "sighting_of_ref": "indicator--8a65c8db-9231-4a3b-bdce-90e5b5152752", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5e8bac4-e14c-459d-bbad-58b231fda65a", "sighting_of_ref": "indicator--9793e3c6-c2f7-4f47-ace3-eda1846f4a29", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3caaf5e1-ee21-42ee-a609-4172a10038b0", "sighting_of_ref": "indicator--bc65af76-1308-441f-8b6b-0e8e126b7206", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a171d8a7-83e0-40a7-94dd-397ecaf3ab10", "sighting_of_ref": "indicator--2840c01f-4fa0-4d92-be21-8523bb2b0fca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93892d21-2ddb-4feb-8932-878ff5ad97be", "sighting_of_ref": "indicator--b0163686-9680-4f63-95b7-8e5e43bed17d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--017cac49-b827-46d8-b4bb-874b11494f2e", "sighting_of_ref": "indicator--b4be7222-caab-4e2d-b7bf-42523d03ab51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf2b193d-6ed1-4579-9001-9d6104023357", "sighting_of_ref": "indicator--c3d64583-f228-426a-8dd6-363a61986f12", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfaba44-6401-4e49-b648-a364733966d5", "sighting_of_ref": "indicator--b3daed87-0996-44bd-b90a-9a52e959fcdb", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dc5c55d-25b8-4ec0-b38d-a383dce728db", "sighting_of_ref": "indicator--7a995725-e6ea-4e28-ba6c-3e3de37e5e31", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c70ac4c2-248a-4a68-a608-3e2a722a6551", "sighting_of_ref": "indicator--28744707-c435-40d8-b8ca-a8f31e04dd7b", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f9f9d51-ae7a-4dae-bf9a-5b93da2076a1", "sighting_of_ref": "indicator--fd06a480-afda-417c-ad35-79173cfb2580", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--499d5ce3-12cd-45ba-8e93-c7a7e356ff96", "sighting_of_ref": "indicator--aae01f26-0c48-40e5-a00b-2fd58c6e2fb3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55615729-f6c9-4f3b-8c6a-599868733615", "sighting_of_ref": "indicator--7b84b43e-f42b-4283-bbc2-9c766df82a2f", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--923defe8-1864-4f23-8fc1-ecd34e4b36bb", "sighting_of_ref": "indicator--ceff95fe-b0a3-450d-aaa3-6a927f2dceb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dcedab2-4bf8-4549-8193-8fea0e7220c4", "sighting_of_ref": "indicator--541d75fe-9523-48bc-bb23-97018fae07ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfcd68d1-5ee4-4ef7-9b1a-7fffd377f6c4", "sighting_of_ref": "indicator--0c8e3b07-50fb-43a2-8a35-aa84158f46dc", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--151b4a0b-42f5-4389-b268-1b39d5f68cc3", "sighting_of_ref": "indicator--8cb1d5fb-711b-45c1-bcb1-b7e347b5f535", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f700ceb6-ba7d-42d3-80fa-15838533c2fd", "sighting_of_ref": "indicator--251f7dba-6649-40c8-ad5e-1d8f042898f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fada023d-e5ac-4169-91c3-33f2796ec1c7", "sighting_of_ref": "indicator--eaf9a67f-0254-4cae-b8f3-55080081a889", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60692533-2af1-4ef3-824b-79f54bb0e3d6", "sighting_of_ref": "indicator--f2c79bc2-e21d-4e1e-9e31-3d67e3d26ae5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5f8a22-3f96-445f-b9ed-65d4d4fd9871", "sighting_of_ref": "indicator--3dbaeb80-6999-4401-ae20-f43335c7dd43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0089542f-91fa-4f0d-bd7e-cd945d4329a2", "sighting_of_ref": "indicator--8ad1593e-2cd4-4926-9287-f7253a2ecfa2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d28cec-7919-4528-a7ca-54ef2346c35c", "sighting_of_ref": "indicator--a64cf017-da69-4005-92a5-3754f60fce50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f54ac0-4809-4c21-b8c4-ab80d42690ca", "sighting_of_ref": "indicator--fba561fa-6ccc-4624-aa15-f03c246faa8d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d23e7c4-44a9-4078-b8bc-203aac29a583", "sighting_of_ref": "indicator--3d5c29a3-4737-488c-b7ba-ca240f41d166", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--880868c5-d6b9-40e8-92d1-0a2912622d86", "sighting_of_ref": "indicator--6fe497d3-82c5-4f00-822c-74644a76593d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8441ded-a129-4baf-ba8c-c86891418af1", "sighting_of_ref": "indicator--cf6e2b90-986f-4083-b549-36e6face343d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b64eb846-fbe8-464d-a82e-67f54a2f1ed7", "sighting_of_ref": "indicator--61d17c1e-fadb-41be-ab77-c437e3d2c176", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d85ae4e9-02f2-4845-a399-b2fc0fed605c", "sighting_of_ref": "indicator--6a91e359-9257-4b9e-aace-12d39c43a401", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b3deaa3-f8b3-49e6-9fb9-7bb8fba2e7bd", "sighting_of_ref": "indicator--2c6488bb-882c-4a2e-905f-6f2486195cb4", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b95aa1b-69b5-4cb1-aa5c-b01536a9fb7c", "sighting_of_ref": "indicator--a44afa2f-b5e3-4e73-8a97-4c1d03b58aec", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe918cda-b7e1-46f9-be61-002c0514cfa5", "sighting_of_ref": "indicator--373a0780-e301-4696-8ece-bcebfbdc3aae", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d84b55-6083-4001-b054-ff001929d45c", "sighting_of_ref": "indicator--15a97083-6819-490d-909b-05ce479dbe98", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61716cb2-551f-4bc4-9f83-5459dc8ad46d", "sighting_of_ref": "indicator--69419243-90e6-43f4-b676-f68e983f0e65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--256d5a60-0c6f-4973-a496-da3b924ac2ad", "sighting_of_ref": "indicator--8bcf08db-6d85-4664-86db-0e36228cf9be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416066be-ae30-4aca-99c6-88f3a6df98e2", "sighting_of_ref": "indicator--66283cd4-3727-437c-8313-0ba009e36598", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e848fe04-ce03-4d9d-bd20-3f0e502374e1", "sighting_of_ref": "indicator--79103c57-61c9-40ad-b205-088719425307", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915e535b-0efe-4909-ae9c-31213b64e4b7", "sighting_of_ref": "indicator--02d38538-8b19-4145-8312-1909050e650d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8553075f-3947-49dc-bbb3-19774845c2ee", "sighting_of_ref": "indicator--128be7d0-4ea0-42b3-abb9-c9cc6c09198b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec80265f-3475-46bb-8c75-f1a0d0b72f27", "sighting_of_ref": "indicator--4774eabf-ebd2-47cc-bbd5-a43b0e6f1e51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--409a171a-19e8-4a68-aa4b-8df5e9a5a8fc", "sighting_of_ref": "indicator--02f15a94-904b-43c4-a847-f2f735702ff6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c6f3028-27fa-46bd-8cff-1b3b35d9c16b", "sighting_of_ref": "indicator--1a913f91-0900-42bf-924d-91054d8d3bd7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c51fcf49-5ae2-494f-b17c-02f70aac0dc4", "sighting_of_ref": "indicator--054ee24f-6c71-4e53-8ac3-73da1cc94af4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83aff9f9-cdc3-4f2f-b6ac-eff1879d2c8a", "sighting_of_ref": "indicator--d9433cb2-c788-42af-99d7-3976367b9f71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d85d6efa-92ad-42a5-9ae5-2f7e8abfa28d", "sighting_of_ref": "indicator--06b95055-ad9f-4c53-9ad6-b6c225301e80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e973050-9db0-47c0-8e05-36ebd0a74721", "sighting_of_ref": "indicator--0dcc7fb2-f852-4c3d-adfa-571e4afbf420", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9eeef3-1a5e-4ff9-936f-cb63538697c6", "sighting_of_ref": "indicator--9aafc60b-7345-4dbc-81a3-ef6004e797f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b3a47b-8895-4b6c-ae9e-f3741b79cd60", "sighting_of_ref": "indicator--bc3c7b44-b8de-4983-a93c-556a4d734d3f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b1a478-f0eb-4d2b-8bf8-d8c119966ce6", "sighting_of_ref": "indicator--39858d1d-83c7-4dd5-a6b9-199776bcaee7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c750cf4-6543-4b2d-9638-13a9e122b895", "sighting_of_ref": "indicator--38140695-4518-4fb0-bf02-2284e60712d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50a3142-b04e-49a0-9454-35a3e024e8a3", "sighting_of_ref": "indicator--1e8ef37c-8837-4668-b20a-edda3b144e07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f20de39-b3e9-42be-bfc8-245aef272a5a", "sighting_of_ref": "indicator--a815a488-fc02-43a1-a45c-9aec0b464184", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b389deb0-b6b1-4fa1-a1ed-25e6c4b3c84d", "sighting_of_ref": "indicator--ae98c155-44a4-46b2-9218-87a78afb7725", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c38195-1145-45d9-82a8-ae9d23548cae", "sighting_of_ref": "indicator--a66c20e5-de61-4f69-b767-ff796b422e4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e65c08c-741f-4d52-880e-69a383ee70d7", "sighting_of_ref": "indicator--c55590fb-96ff-44f9-934b-7896d91a7027", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0b79faf-524a-4f2e-adba-87d9e161cb33", "sighting_of_ref": "indicator--fea12f57-9b7f-4672-84d5-1cdac2f53a4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b247b64-70ec-487e-8f25-96954547a444", "sighting_of_ref": "indicator--be11fbcb-f059-448c-9257-ec75298d25b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0558b070-e304-4ad7-9823-22be65960ce7", "sighting_of_ref": "indicator--5a3de328-3d0d-4f9e-a88e-f150a0b43488", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643e148c-ba8c-4434-9bea-e7b7219b16ae", "sighting_of_ref": "indicator--26fa9c07-c5d3-4e2c-9c12-5aa2e98da536", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee25b65-6864-4035-9241-be96a4661297", "sighting_of_ref": "indicator--90c9e3bd-2338-4fed-beaa-66bfa451412a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50d98ad9-fc56-48ea-9959-e3c44da887e9", "sighting_of_ref": "indicator--78d0d409-2c42-4fec-8a97-708db7f50a9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58f110cd-aa09-4da2-bf9a-928dd2ed8bf3", "sighting_of_ref": "indicator--c843ff4d-2135-42ae-b5a4-cd84b20c6119", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--268c51cf-7ebf-41c5-ad1b-0f49242ef819", "sighting_of_ref": "indicator--eb6d7729-80a7-40b1-bf34-bccd41bae88b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--880783ca-102b-4743-9047-9e1d0db645cb", "sighting_of_ref": "indicator--3216d7d2-aacd-4ec6-a046-d530fc8de64b", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--849df178-6726-402b-9cf7-42054b0bd14f", "sighting_of_ref": "indicator--30be3e90-4b36-43c3-a8a0-672e8073d7de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--901ef041-d3c8-4223-8a5d-a401eed919a1", "sighting_of_ref": "indicator--2589d35d-9a0e-42e1-ad3e-6edab73f3c09", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7204327a-5d6e-4e2b-8f21-5a90a3a6f904", "sighting_of_ref": "indicator--58a2e779-e4c9-44be-b972-f896179748d5", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d9c4abc-650b-4404-a83b-285da4d83c8a", "sighting_of_ref": "indicator--209276ea-d9cc-448b-8e76-01d370dd5f73", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce6ff149-583f-449b-b3ba-4cefe3769429", "sighting_of_ref": "indicator--9803cd23-ebe5-4b2d-96be-da4582a340db", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdaa42a-cbbc-4fbb-b2cc-e3e9e49de9c1", "sighting_of_ref": "indicator--56161186-9d2c-4122-b690-e800a0245b50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff061cec-672f-4b46-af92-4977673d0e75", "sighting_of_ref": "indicator--64b7ac64-3e47-4cee-a70f-b290a2c9c795", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61dd6223-d880-4924-a78d-4b9703d76112", "sighting_of_ref": "indicator--347be630-8b95-49f1-96ec-74056f1e82d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe8b0dc-35af-4a36-99f3-a42a183ef0f8", "sighting_of_ref": "indicator--42463d46-6846-4544-812a-93b6c1e23786", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc07f4f2-ae07-4847-9f0d-0fb6dd3b496c", "sighting_of_ref": "indicator--bba3a14e-8deb-41d4-bf62-e30ac3b33e79", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d6b728-12bb-4d8f-af2b-54583b0dee92", "sighting_of_ref": "indicator--79f130e7-a490-4102-a1ab-eeadbcacb2bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ecf2438-1478-4fcd-b0e9-0235cffa57d8", "sighting_of_ref": "indicator--b1cd534a-7348-4987-8f91-e6937b3eb75c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08525f28-f866-40ce-8145-fe2264b7e391", "sighting_of_ref": "indicator--df07c313-96d4-4b73-93a2-5a45e92730c3", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4715825e-17cc-4da6-a0ff-754bf69ac640", "sighting_of_ref": "indicator--68b1fffa-f093-441d-ba2d-61c80094db2e", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e539d9-8c78-4292-a1c1-f0c1e5304b81", "sighting_of_ref": "indicator--71bd9f60-3495-4106-a58b-5b2297ed2375", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c82df93-1b5b-4fbf-a25d-6821da3aec7b", "sighting_of_ref": "indicator--927baf6f-6c9e-45d2-ab47-cee726bb5247", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032aecf8-73c6-4aa3-a957-924ed511456e", "sighting_of_ref": "indicator--fa17728a-ee5c-43db-ad75-6aebe780ab7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01aae60-cfde-4d8e-910a-084619f32670", "sighting_of_ref": "indicator--f3ed568a-377f-4605-b2bd-f77f83ca1adf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5e85ddf-04b8-4ba8-b1f5-e0e0f52f5183", "sighting_of_ref": "indicator--8db79ad5-d908-4504-bbea-717d5a120f44", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83da99ec-04ed-4619-b2ed-e27728a2d2aa", "sighting_of_ref": "indicator--8efbdbee-07bb-401b-bba3-9b3280669331", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ff7aff4-0e62-4312-b402-e23d4b7d1f16", "sighting_of_ref": "indicator--e63b2bd1-2ad4-4d50-900d-00ca6b036182", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d560fb6-09b0-4061-a4b8-5efff52508fa", "sighting_of_ref": "indicator--ad1dbf00-44e3-4354-8cd1-525d27347bf6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b93569d-49bc-4c3b-94e8-440548a259ee", "sighting_of_ref": "indicator--c1dea3fe-bd7d-4d6b-be6a-9946751a9e44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--797c160d-c5a2-46a5-a9fa-baff708001da", "sighting_of_ref": "indicator--10c7e201-71cf-447b-855c-a0487cf8d749", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd7b1b59-6a85-45cf-ad6c-ab677eb27b5c", "sighting_of_ref": "indicator--a1179aaa-342b-47f1-80e1-45b8b90090f3", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6677e1c-e841-4324-a586-e72c97a80849", "sighting_of_ref": "indicator--e2cfed5f-118f-4828-ab93-00542a72c544", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ae5c48f-fa48-4db5-9468-6b063f0288f5", "sighting_of_ref": "indicator--8c490aeb-e49b-4108-bdf8-82c7503981a5", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc48634-2e36-4bb4-a733-979ab59b746f", "sighting_of_ref": "indicator--ab508140-ae07-4198-a7e2-7b54fe5ad869", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e83cfaa-d402-4767-b7ef-1688c3671bed", "sighting_of_ref": "indicator--1f4782ce-074e-47b7-a590-f8289e69ecc2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7438363-dccd-460b-8ebe-beb73399809f", "sighting_of_ref": "indicator--fef6225b-0d8a-43d5-9d75-18e5f51a39ed", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46618cb8-7229-4d47-9d78-321f5f6971c9", "sighting_of_ref": "indicator--d853aba2-609e-4cc3-b1dd-8c1adf7fa1b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3baa7ee0-2027-4108-8772-667964529a56", "sighting_of_ref": "indicator--2df5ed9c-4b19-4bf6-b47f-871434a60b4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--775dacd1-a2e8-4948-9213-bf558067ac91", "sighting_of_ref": "indicator--54b7e83f-a818-44cd-b656-bfe532a69775", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--882105d1-4c23-4688-a27a-258be4fd5c7d", "sighting_of_ref": "indicator--8627aae9-0c83-4ef0-99a9-a8e229405612", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27d9b629-c983-4043-ba56-17f706a1f563", "sighting_of_ref": "indicator--33013f81-b98c-4607-8006-5c60dc95a05b", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8661a11e-b736-4cfb-a7d8-4273dcc8c419", "sighting_of_ref": "indicator--6fa94690-e32c-4148-881c-30ed75563bbd", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e257834-23e5-4379-b27d-d76e6e1b0dcf", "sighting_of_ref": "indicator--a548fd03-d271-4b6b-a343-614c03cd5146", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe6394c-8bf2-4312-b872-32867335fe8e", "sighting_of_ref": "indicator--cae65ac6-3736-4164-b4cc-d2d7aae784fc", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a2160e-d9b7-4326-b5d8-c8c3653c4b0c", "sighting_of_ref": "indicator--46da3562-de82-4231-a084-dd67d88f1913", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7485befe-81fe-4ad1-a2f2-b15334a29fd1", "sighting_of_ref": "indicator--9caa6064-71d1-46ed-b96d-d65a95cee8ab", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bfa4bd1-19f7-4a5f-85f3-dbd40f566bee", "sighting_of_ref": "indicator--5bf345cf-47e4-47ed-8d49-b9c3700a3ad5", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edf36fa0-7596-47dc-bf5d-904967191ee8", "sighting_of_ref": "indicator--4514e0b2-aaa2-423f-b464-82ee3a6c385e", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0455714-7737-401a-a781-03b5fbb6fc62", "sighting_of_ref": "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccdf46bd-8a10-4c69-b962-e95a229a7df1", "sighting_of_ref": "indicator--d8fadd79-ae7e-4b98-96a8-d91e0b24c94c", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c0eb9d-36c0-4434-8ed1-0a09a2b1b8a8", "sighting_of_ref": "indicator--d5be07fb-4daa-4dff-a279-97daa6d1dd23", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42469e9-8378-4fd1-8ebf-271025ee0136", "sighting_of_ref": "indicator--5e8e0cac-31be-47b3-9d43-4b7ee864a73f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd36c18f-84ef-4dfb-8b7a-d09537a14446", "sighting_of_ref": "indicator--68d16904-6005-4453-a0da-0adecc0c9495", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52131e85-a585-477c-aaa0-3eb2bec76a94", "sighting_of_ref": "indicator--09fe8c53-04d6-4517-b31c-64254b4c62cd", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d3b3096-5e43-4cbd-9211-61528d6d67e2", "sighting_of_ref": "indicator--9c15e234-325b-4d37-9cdc-bbed11ef2fee", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b70db66-14d0-43e6-9f68-3cc918994953", "sighting_of_ref": "indicator--5166f854-f98c-41b9-881c-ffb34371472a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6276018-53ad-4164-ba9c-c35d582d2c03", "sighting_of_ref": "indicator--216fddca-d673-4da0-afa3-02a874a17d6e", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06137e54-a825-4498-b6ac-97681bda862c", "sighting_of_ref": "indicator--2db12dd8-21f8-4e88-a183-1f1eaf795264", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b0782f-332a-43f7-a0b2-8cca064bd8e9", "sighting_of_ref": "indicator--9f5c8181-c7c4-4413-a0b0-c7b695c1cc66", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--846e6be9-b355-45b9-9e63-65c1c7ff90fc", "sighting_of_ref": "indicator--3b56b505-e4f4-4cf6-8885-dfee619e488c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97d1e4b1-0da0-4f92-92f4-b3c9a8ae3d06", "sighting_of_ref": "indicator--3fbf1fae-dbb9-41d0-b518-00064d39c7c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c40ca135-4817-4dbb-96d6-3a79a7bfeefd", "sighting_of_ref": "indicator--84958e64-d513-4042-8c85-45b2bc3c135c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b225b372-89b6-426c-92e9-2ef84f889fd2", "sighting_of_ref": "indicator--7489a4fc-6067-40c4-8546-1564e5434905", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e34b6b4-0d39-4ff9-87ad-e2538e7bd97d", "sighting_of_ref": "indicator--eeb10e05-5ec2-4aae-af5e-4f13e22f8ecd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b13a4a-7457-48d8-9c29-e6eb2bbd5e96", "sighting_of_ref": "indicator--92a5343f-0db1-4ee4-bd05-2efbb67172dd", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd80dc1-d8dc-4fb4-9adb-c6e919923d6c", "sighting_of_ref": "indicator--16cc8c8c-0953-4a7c-b8ec-f48d23cbccb6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c54d20d-49bb-4792-89bf-b64162670207", "sighting_of_ref": "indicator--fccae0ab-e725-47fb-ae44-808e83def3a4", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f24ee517-65af-469e-9acb-5acd24393223", "sighting_of_ref": "indicator--8869bbeb-9bf9-4ca0-923b-248b5ba0e0b1", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0384481e-77cc-4149-83a6-24b59c6daf53", "sighting_of_ref": "indicator--2b265ec5-48ef-46dd-897b-7d038158c77d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f41a502-9038-468d-98af-10e8a376e10d", "sighting_of_ref": "indicator--52d84a24-dfc0-4e9b-aff8-c59b00d4e7f6", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7e28b18-27ce-4958-bc1a-d827c3b63e1e", "sighting_of_ref": "indicator--55889582-099b-4c7f-b069-a1e1f098099e", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be2fdfff-bb7d-403c-a2e1-b5dafe925d59", "sighting_of_ref": "indicator--0517ce65-41b2-4bb3-ba3a-a1760a45cedb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ac649e3-21a8-4186-b660-c96d55548bef", "sighting_of_ref": "indicator--b6167153-373c-4062-b1a1-45d9f2d2ce3f", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb3dc9f1-935b-4287-a376-73f0b9169f9c", "sighting_of_ref": "indicator--f612ea4a-0bfa-4a81-8958-1f32822bcf55", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--572e3edc-e6c0-4e61-9064-43d9e42d1f51", "sighting_of_ref": "indicator--05a2c58f-2b9c-4431-9cfd-46f77097affb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df1539f2-c1ab-4c51-b0b4-b00b7a7fc267", "sighting_of_ref": "indicator--4c5935b1-cf4b-4747-9cf9-0a11e1006507", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e168e75-5e47-4779-8c97-d877cccd2c7a", "sighting_of_ref": "indicator--2b2e034a-5ef8-4a35-9a81-6ff87ca274e4", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d78de1d-0d29-4df4-93df-d2fc519bde84", "sighting_of_ref": "indicator--19322f82-6f5c-44c4-b17c-a0234bf73d4c", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67204928-4ce5-4a54-a259-0336b9f7ad9b", "sighting_of_ref": "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7f6b72-3f82-493a-b90c-668b3b98f6ac", "sighting_of_ref": "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe2b58bf-2df5-410d-bb5c-607a00bd2729", "sighting_of_ref": "indicator--9423b1d9-21d2-4206-8cee-8c1a4f0c5a9d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3c5613-08b4-4408-9006-c57c31b45c88", "sighting_of_ref": "indicator--191c5709-10c8-418a-aafe-bba5e932df32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d109116d-d359-4dc7-9d34-55f9ad363fee", "sighting_of_ref": "indicator--a5dc93ad-fab3-4dde-82fc-b5b4381064e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea73acff-1718-4af5-8269-7b89885827f9", "sighting_of_ref": "indicator--3f8ea8fb-1d84-4c71-b465-3b575e13a7e9", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9da507e-cf7e-4517-9891-7209786e2057", "sighting_of_ref": "indicator--e76ca79a-ba10-4132-841f-fce4b8ff1671", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da782913-b8af-4f33-b1ff-cf40ca5a54b4", "sighting_of_ref": "indicator--38d645d8-fe0b-490f-a523-80615877e14d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2f29336-2298-4aa4-9e2e-7748229a834b", "sighting_of_ref": "indicator--e6e9d880-7451-4ec5-8512-c02239723fff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c6314f8-a81a-4f93-8fef-3177a0a5c4b7", "sighting_of_ref": "indicator--c1ce8126-9af0-4d2e-b3fd-4e53d3dc170f", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913ea743-eabc-4447-b9d7-a0bd3c0bea61", "sighting_of_ref": "indicator--1d27482c-1c26-40ee-bb62-efc9ff2fef62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0d021f9-a8b0-482c-bf5b-b1e59830af91", "sighting_of_ref": "indicator--39832c21-ed94-4d9e-8492-6875a6fc2dcb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43edd22e-04e7-47a3-ae03-94cf96f75df6", "sighting_of_ref": "indicator--bfb9a84b-74de-412c-9fb1-f1fbfe5ae4d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e19cf7ba-c0ee-4171-82fd-4ff04ccefcb1", "sighting_of_ref": "indicator--05ab9338-3cf5-4501-b3db-88defa390950", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86030c44-39ce-44b7-a89f-02e6a0ece5be", "sighting_of_ref": "indicator--3d6cb07f-501c-457d-93bd-46bc58730121", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d20788-e963-48b9-a239-a57583c29e89", "sighting_of_ref": "indicator--80770f02-fb04-4c7b-87fc-08550b473429", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31bb247f-dd91-407f-9b70-869dded9f3b6", "sighting_of_ref": "indicator--7ec69f05-11a0-4cac-851e-d31babe44dd5", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff07454f-23fc-4b00-b530-9f033dfe2313", "sighting_of_ref": "indicator--223c8ebf-d4d3-4f63-90b9-db8bdfd3eff7", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccc0381a-998c-4590-9bf8-cf1a2fac1068", "sighting_of_ref": "indicator--3eb1c24c-2d3f-4a42-9f51-de62aedd96de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd0d5c21-8be5-442c-a110-14f644d93eeb", "sighting_of_ref": "indicator--e894524e-eb26-4bb6-8336-f204dc6dd441", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c6f7eb6-4d7a-43bd-97cb-b1a27bdab005", "sighting_of_ref": "indicator--ba40d5b3-f9f8-4b0b-ac18-033bc73836bd", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb971739-c09c-467b-800c-35e751636ae1", "sighting_of_ref": "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dc962c3-0874-4297-95ee-ee07b4ecf4b5", "sighting_of_ref": "indicator--a3407590-910c-4342-840f-9b74eaf9f0f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a0ca6bb-0ec5-4510-a253-e8603122fe23", "sighting_of_ref": "indicator--39b87c43-18c1-40db-92db-dfc55c495206", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293308a9-60ed-4936-9b06-7667542b1d25", "sighting_of_ref": "indicator--727489b8-2edd-4fa8-80b9-d14d3f322350", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9afe31b-13a8-4da9-866d-46fd9edb0fca", "sighting_of_ref": "indicator--45768ba0-2c74-4c87-88e6-1be62ce705c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2058d20-31af-4b5e-94ea-1e1ba1e2ef17", "sighting_of_ref": "indicator--45768ba0-2c74-4c87-88e6-1be62ce705c2", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bcd757a-b9f1-4f52-bec3-1fba2f96d4b1", "sighting_of_ref": "indicator--7c86f8d3-02db-4cd8-8e60-21f8697181fd", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e612535-0db5-4c6f-9eda-8d1b1da16a09", "sighting_of_ref": "indicator--b2d2be9a-76e7-49ce-a0e5-b729e765d6b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc90f7a4-397b-46cf-93f4-a1bfec64561b", "sighting_of_ref": "indicator--a8a8594b-2e51-4782-ba62-3a4ed251498c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38409068-ca45-4c88-b564-59dd2ecd6b5d", "sighting_of_ref": "indicator--80767eb9-3941-481e-b875-d71e220191a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91318517-f13f-4723-b4ab-8f4891721f94", "sighting_of_ref": "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2e90764-8144-4b9e-b61f-95f64f7aeb90", "sighting_of_ref": "indicator--320045aa-9a52-441e-bbee-57222a98bf6e", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66d773a-c42c-4aed-ae5c-8b8b7c3db251", "sighting_of_ref": "indicator--54281e82-d7df-4e65-88b7-3284bd6a88b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1853f9b-83e4-4a9a-b16a-954d2244ff16", "sighting_of_ref": "indicator--0cbdb823-e5f9-466d-a7f6-2782c58a8d1c", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dcf1c94-a8ae-4dec-8469-1ecb16331a47", "sighting_of_ref": "indicator--720f9039-2366-438f-aac8-9e749bbfa2f1", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--251c4a1d-e18e-4563-8860-0b4358d0a7d6", "sighting_of_ref": "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--939e1606-737f-421f-98b6-46e60507dbf3", "sighting_of_ref": "indicator--1059aa62-97fb-4b62-81de-aafd0401087a", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--277c0b9c-5cd5-4ce8-ab4c-c406275952e4", "sighting_of_ref": "indicator--ff6e6c98-400b-43cc-8639-dd352766c75a", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39c1d6d2-f695-4d20-ab73-864036e0e2d1", "sighting_of_ref": "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55a8247c-9c66-4644-96bd-c24d5c37231d", "sighting_of_ref": "indicator--371d9026-7bc9-4f50-a3a4-775da188f507", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a582e5-fd53-45ed-a8bb-79235b7ec137", "sighting_of_ref": "indicator--e62e1cfc-5c54-461c-bb29-47de4dbd3ee6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa51a30-4d42-4544-8235-462c395967db", "sighting_of_ref": "indicator--432514bf-1998-4e54-b680-87296821dfa4", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93696c86-6017-49e5-99ee-a2c10b78c498", "sighting_of_ref": "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f87485-74bb-4984-bda0-6a3d7c168c9b", "sighting_of_ref": "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ae5cb7c-7964-41af-bb66-0bb3ddfd2476", "sighting_of_ref": "indicator--6193c6f3-219c-4020-a0d9-2b706d9e6df6", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03c933ce-d7de-4b60-99c0-12f0f5df4c8c", "sighting_of_ref": "indicator--b12a28aa-d4d0-4c41-a27e-d1d9f22540de", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a70d9e29-d061-481d-9b43-06bd83b26ade", "sighting_of_ref": "indicator--76dbb022-a92c-4f7a-aadc-1ce2ce79f3a3", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e9165d5-2283-44b2-a8ec-c3b45da240d8", "sighting_of_ref": "indicator--bb5f6071-e33b-4b4e-a7df-54582d1c1ccb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00fc9e5f-fac5-42d2-84ba-1d5d3d6d3428", "sighting_of_ref": "indicator--7cbfe2aa-c405-401d-87cb-647a414bf315", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15a7a87-0ded-490e-afd3-70f7b4c688de", "sighting_of_ref": "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01d6873-0b64-42d7-9dd1-3ab9980b4548", "sighting_of_ref": "indicator--1bafc03f-1b2e-4c10-a9ca-afea3fbb87dd", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa25846-d022-498e-a2f7-e9a865650d1e", "sighting_of_ref": "indicator--9313eda6-6eb4-49c8-a7d6-582b0ac65ad3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913697f5-4ab3-4363-84fb-f34a7b34499a", "sighting_of_ref": "indicator--bb810d13-1d72-4037-9f84-fb4b3c1b6c0e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fa65068-53a4-4953-8a7d-90d3fc72ff3f", "sighting_of_ref": "indicator--f9927899-48cb-4af4-8fe0-7bc17bf549f8", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ed98cf-cac6-42f2-a1dc-6e4be4ed0eef", "sighting_of_ref": "indicator--73e8639a-393d-4a10-975f-9faa9d646759", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a93988c5-3dff-4270-87b8-5f41ee8127bf", "sighting_of_ref": "indicator--7800d8de-c47d-4895-9140-0b4ea6a5825a", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17489c6d-c1da-4912-9ab5-c7ba36658a78", "sighting_of_ref": "indicator--be5ddd2d-dddf-4d34-817e-cc1515afabd0", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8425fe9-922b-47d0-a6ee-9eb864603ba4", "sighting_of_ref": "indicator--e70b9712-4a1e-470e-bdf1-11d58cdb4b83", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5826c3dd-ad10-4416-a3d5-3c52e0d81eb1", "sighting_of_ref": "indicator--f1f1cc8c-6c0b-4c28-9188-4ae6b249106c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca53561b-39a6-4d81-981f-2f66e723fb10", "sighting_of_ref": "indicator--f102c45a-0480-4cf0-9586-b591c80624d7", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b9db1c-1ddf-4d87-a30f-0de976038f9e", "sighting_of_ref": "indicator--86be901b-daf9-4eec-9664-642438c79dfd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4783c2d-a003-4a78-abd0-0b16fe2560ad", "sighting_of_ref": "indicator--d18bee91-62d9-446c-8ba7-0906618c63b2", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba528ab1-be2c-4e48-a089-86304da91812", "sighting_of_ref": "indicator--8dff9e4b-efaf-4a28-af6f-bdf391009eb7", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81842d60-f319-4ac9-9e12-3f465da0bfbc", "sighting_of_ref": "indicator--e94e2222-bb3f-4367-a6df-34bf583cc919", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b49397-c0c7-4438-90d0-512ea21a9c71", "sighting_of_ref": "indicator--30255714-bd56-44dc-810e-60ce8736dac2", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee260af9-374d-4b3f-9f88-ac15b159f0cf", "sighting_of_ref": "indicator--5086a3fc-0bcf-49f0-bd28-3d21b93773be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c499916a-1d5f-4dfc-a155-7b680b44f295", "sighting_of_ref": "indicator--d717181c-e61e-4c15-806c-81187ca1fc4d", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e91468b-d988-4203-b1d6-20fee29d0540", "sighting_of_ref": "indicator--bc7a905c-2338-400e-b770-35a39795fe46", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eceaa003-bdd0-4741-ad80-22a6874fe48f", "sighting_of_ref": "indicator--0093ee09-caf8-4d89-9392-866db1598a1b", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b2d3764-cd49-4376-8f9b-6201efe80bc6", "sighting_of_ref": "indicator--45b03561-a129-41ac-9507-5132440721d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa71653c-1fcc-489a-805c-b00814f326f4", "sighting_of_ref": "indicator--4d5e1d28-df1f-4fb7-a216-fbb6f0dfc1e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--600f305d-97d8-4e77-a662-8d0227a95144", "sighting_of_ref": "indicator--761029a2-00e1-4c15-b4ca-a388af57dbc4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c6303b-050c-45ef-a66a-65d8c24283e0", "sighting_of_ref": "indicator--1e1efa34-fd1f-4980-ace4-cd1814c9e62a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6cbddef-513d-4722-a9b7-410e58b1174d", "sighting_of_ref": "indicator--5075d238-85ac-4e04-af11-873b00d4f7dd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dddca9a-0b86-4028-bc00-e72123c65a83", "sighting_of_ref": "indicator--58c488bc-6b43-41b5-96f2-bca25d64b9cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ec275a-c209-4295-8089-38698cf79988", "sighting_of_ref": "indicator--427f6cf7-acc3-46c1-9f49-eb27c4ace034", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--704e5456-c607-41cf-b883-2f3a9f24f326", "sighting_of_ref": "indicator--615be48a-86ff-4001-ae6b-42b4aa24b91d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0474464a-059c-4b59-99c1-b83580168814", "sighting_of_ref": "indicator--f3a74d88-fec3-4d6f-8bb5-514000d52550", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b1cb747-1cbe-47af-9639-775ceae40ec8", "sighting_of_ref": "indicator--f0667ab5-b879-4015-8a2f-215ff7003e53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0aafb2-88a2-4622-b1ae-dfe465c98785", "sighting_of_ref": "indicator--fff93e92-f7b5-4459-8654-f8cd04c03e81", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4130ce0a-df89-47a6-88e9-df16e4bcdb48", "sighting_of_ref": "indicator--5fa1da65-68a3-40e9-a744-5450a4c44433", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ce1ffbf-ac4a-42fa-842a-03fa9723c09c", "sighting_of_ref": "indicator--9c5a702c-3b0c-4b5c-8b55-773914fdb51f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caf04869-d6ac-44c7-a691-3350f8b4ef8e", "sighting_of_ref": "indicator--aed41e06-5483-44ef-928f-86a35c0a8167", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ded4fbf-7b21-4590-8788-8451a1d34d9a", "sighting_of_ref": "indicator--49fa2b52-1ae4-4470-90cf-413f990c922a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4197a02-0a89-4ffb-ae6c-2e7ce3dc2044", "sighting_of_ref": "indicator--7b546675-0954-4484-ac0a-a4f44b8de0e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e493e646-48f6-4c04-ac04-f74e566b3c27", "sighting_of_ref": "indicator--a01ec627-ea3a-4e2b-9173-9428def57413", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f46fe685-3253-42a4-bd81-ac32e3450a4a", "sighting_of_ref": "indicator--355bcf30-ee75-4ef1-9909-22c67f77f056", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3e57f5-777e-4750-be03-7409a7806e3c", "sighting_of_ref": "indicator--503fa007-9fde-498c-bca8-2c37df15f751", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc257428-8110-4dba-b7fe-62260ec8ccc5", "sighting_of_ref": "indicator--f07b4177-8640-428e-a384-76d63b5b141f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86f3434c-9ae1-482e-a504-3cdbc74c439e", "sighting_of_ref": "indicator--e27ed6ae-50f3-4cfd-bd6e-c1004ce80b07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b1db3b6-1ac1-4a6a-a6a2-8be843cc06ee", "sighting_of_ref": "indicator--7926e513-0810-454a-bafa-c22ea3c6c682", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1410569b-d587-4edb-bc6e-a02200acd711", "sighting_of_ref": "indicator--a6ac2dcb-f26b-4163-ba2d-f822e3d8a9a4", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2258eb2-af86-4357-8247-b186cd83b7f6", "sighting_of_ref": "indicator--ae25f092-edd6-4bff-8686-a6d58f6b3793", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41024ed3-3d74-4653-9353-d86418b2a603", "sighting_of_ref": "indicator--bfe4cb17-83fd-4eef-8067-57d2acc0d740", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c27b0384-0a32-481d-9ade-574cc60d55a3", "sighting_of_ref": "indicator--ea8fe99f-f77e-4e1a-872e-84979e4cffce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f40be354-6e5c-48ba-9534-e873c3d53c98", "sighting_of_ref": "indicator--af12abee-3ff2-4129-9658-a8ce3f309f62", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a96985-af9e-45df-9e3e-99e97a448308", "sighting_of_ref": "indicator--1d246071-a625-474d-ae1a-bbe679251c62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b2bf03e-006e-4ae3-8ba3-c9db144fe179", "sighting_of_ref": "indicator--8acfcebe-01ed-45af-882a-160974842142", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d377cb-95f5-4663-85d7-9c6433684dcf", "sighting_of_ref": "indicator--defda975-445b-480d-917c-eb9748ca6f1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcffd7b7-0765-4fd6-aeb8-fc8d25ce21dd", "sighting_of_ref": "indicator--7e5c8eab-c080-49df-b98e-0ff2076dce45", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75ebc3f-91be-450c-bb0c-a990963ae7c2", "sighting_of_ref": "indicator--43876cd8-b97d-48a9-9320-5935326f25b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a668c6-dba8-45a6-b74c-2946426fdb39", "sighting_of_ref": "indicator--12433258-e181-499b-9a31-62ba7ef435fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--758c2d9c-e3cd-4fcf-83de-ceaf31670f1e", "sighting_of_ref": "indicator--6da5d45f-0149-407e-89e4-b926cb9c32d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd73c5d-1fb2-406a-a722-4bd32980096d", "sighting_of_ref": "indicator--d89dc6bd-af69-46b0-8c06-55cfebca8325", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb71cea5-5453-4744-99dc-ce62e01a687e", "sighting_of_ref": "indicator--1d5fe841-903f-4363-b05c-cc61c9bb97cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b95f43a-57fc-488d-aa69-f2f56cba06f9", "sighting_of_ref": "indicator--b00f9057-b904-4487-93d4-57ee2ac3657f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca377393-b877-4f03-a3d0-d5b6e87faff2", "sighting_of_ref": "indicator--d28254c3-3e6b-4086-9708-4e08d9b2aad2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2e87241-93e5-425a-89d7-a8a8a2f07f59", "sighting_of_ref": "indicator--b44d1573-1484-46bc-a496-45865003f635", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ddaa44-0c88-4bc2-a2bb-53d805253f5f", "sighting_of_ref": "indicator--e1e34648-569b-4054-9ece-07544debfaff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a49e7b79-81c1-43c4-b621-f7cd0ce356fc", "sighting_of_ref": "indicator--7645da11-69b5-4cf5-91c0-963a58346d76", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8f3308-1613-4e63-9c06-e24698062776", "sighting_of_ref": "indicator--ae60a890-2055-4abc-8c82-fda639dee084", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--187f7cc1-1585-4448-bd88-c765aae831f3", "sighting_of_ref": "indicator--9ff4f147-ffea-4648-830c-7737b8b9916e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--892d7a42-d92b-4bfe-9564-bb8db5ea519e", "sighting_of_ref": "indicator--f34a0cf4-ddb1-4196-b740-80be6a47af7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c70c6a0e-461f-477b-84ce-d43832cecbbd", "sighting_of_ref": "indicator--3b0e8d8e-95f8-4991-a710-a4ca3983f550", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd42fbbe-b97c-43c8-97a7-1092437965ec", "sighting_of_ref": "indicator--c8371542-19a8-4434-9122-241b091160ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--255a022d-1e71-457e-be43-4ddaed2eaae6", "sighting_of_ref": "indicator--025a55f8-662f-4789-9f8d-622eb08d8f47", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39129ba3-9710-40b8-8d06-d853d9aa5264", "sighting_of_ref": "indicator--fa0f22dc-5f2f-49e6-a3f9-bdbbb3d6f108", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--238a0ea4-4ca5-4551-b9f0-75c3031ebb56", "sighting_of_ref": "indicator--0efa5431-e997-4038-afb3-ab20f6e35ce0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e76c9b8-06cb-469d-9ba0-b5fd3aba4f6a", "sighting_of_ref": "indicator--8a39b54b-098d-4836-ba10-95acdeed4f55", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689b9598-f3ab-4ca9-a7c1-22776fb74ae3", "sighting_of_ref": "indicator--064ed2ee-8386-4d06-b167-2227e7279bbf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf191f33-301b-491b-9f76-de032b989f85", "sighting_of_ref": "indicator--4659c312-101c-4d09-8789-4e7b9f127027", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd3c77e-060b-4116-a1bc-db06134444dd", "sighting_of_ref": "indicator--d9cd1ba6-79e0-47d4-9596-39aac69c936e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9effdc8-07e0-4432-8e13-2755fbbe6c54", "sighting_of_ref": "indicator--d64ec72a-e6a5-4c9e-a09a-73909247d7d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8c8c3c6-8769-4bdc-a5fd-e9de44af75d9", "sighting_of_ref": "indicator--80312726-c105-4b12-9d1f-78534b9f7026", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7adf966-7fb3-4694-9e17-e89dba86c8aa", "sighting_of_ref": "indicator--a8402905-8919-4c53-859f-c8140600c537", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ee09a14-1c2d-45a4-9267-fe1da911aa85", "sighting_of_ref": "indicator--dd5043b1-2c2b-4a39-b537-27b69864217c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfae48ac-2fa6-4d76-b144-e2fc0d0c5eb0", "sighting_of_ref": "indicator--d944c95d-41d7-4f92-adbc-dd44f6e7f348", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f98804b-eb03-4b72-8af9-2c8729ee2104", "sighting_of_ref": "indicator--8d4b2247-7ebe-416b-9826-ffe528a852ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b54fd5bd-ffea-449c-a2bc-6f5e326fb647", "sighting_of_ref": "indicator--ea6514e8-c313-46e6-8a33-3622fe530649", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aa00bfa-36a5-486d-b102-9dc078fa7d5f", "sighting_of_ref": "indicator--7b2e02af-3991-40d0-b8d6-08999ec2cdb0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b27f8e55-5fe4-4ea2-8583-8e47e139b591", "sighting_of_ref": "indicator--07f4893b-692b-463c-a7af-2728da70a84b", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d58e933-e36a-4510-add6-ee830896e46c", "sighting_of_ref": "indicator--5578a61a-712b-4ad3-a6b1-ec45f56a7ee7", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a3e567f-e969-4265-ad7d-5b9c997f3638", "sighting_of_ref": "indicator--3abdeff4-e9cf-4f33-97f4-614454536be6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0575721c-7d72-4c8c-9326-e7ccb39cbcb1", "sighting_of_ref": "indicator--11b4d9ad-27f2-4038-b41a-735d725d6853", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b62dea80-9601-4728-a21f-11c4fa901ce8", "sighting_of_ref": "indicator--81a3078b-027e-4a7b-9bd6-46ec0a93ca93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf28ac5-768a-4cdf-ab65-99fcd557ed73", "sighting_of_ref": "indicator--dcd5541a-a436-4973-b3b3-7c0eb86eeed7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61df6efe-1bf2-4e62-ab70-a73071c0e568", "sighting_of_ref": "indicator--133fca3b-7b10-480d-a5d5-20e851f1bf73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad851636-07e1-4859-ab6a-17c5dacb174d", "sighting_of_ref": "indicator--f9f813af-72e0-49b5-8cd6-b905668ec20e", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59b10314-1e45-40df-bfd8-69f2d2cb14af", "sighting_of_ref": "indicator--2f88eafd-59c8-4b4a-9af0-0d49f1da01cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877a0ca8-a91a-4f1f-b2f1-9229ac9c2adf", "sighting_of_ref": "indicator--2f88eafd-59c8-4b4a-9af0-0d49f1da01cd", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cead72dd-fdc4-4cb2-9f3f-d7e90d89fc6d", "sighting_of_ref": "indicator--fc01f9f0-d096-4a7e-866e-53013addfeda", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ebe6a1b-d799-43bd-bd72-ecccedf83cab", "sighting_of_ref": "indicator--f49d71a9-54d4-43b5-bfbe-7028d00fff2d", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5261a5bb-8001-4f3e-aa00-046908e07979", "sighting_of_ref": "indicator--9d87e9ff-e4ab-4969-becd-b9aebff34f00", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751a2629-54d1-4827-9951-9fb7efd396b2", "sighting_of_ref": "indicator--f373dd2f-22d2-4c5a-8cbc-8946d5af1aef", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6050d0-5bd3-49bc-83a7-10a7064b99b5", "sighting_of_ref": "indicator--f55281d1-aa3a-427d-9083-99f359f87063", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c348dec6-f1ae-42a8-b863-6081816942b0", "sighting_of_ref": "indicator--6cf1edf7-3ef0-4a2e-b17c-f73b9fe67c9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40288eae-85b3-44c5-989d-37b3642df1ac", "sighting_of_ref": "indicator--d596d539-1dc1-4877-acbd-73b350da542a", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f28e72-5a4a-466d-9208-10ed3b620824", "sighting_of_ref": "indicator--2d0ca396-8243-4fc4-af14-2f4758ecd183", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f813bbe-39d9-4209-b1f1-1f0ab4055b8f", "sighting_of_ref": "indicator--c944c276-d46c-4194-b21b-2c2fbedae370", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a5d8fd-5055-4701-8292-faa76a905a7f", "sighting_of_ref": "indicator--1c061882-08d9-451c-b76b-e7ce041ea82d", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70838ca9-ca0f-44e6-aadc-db7ee60f4ca9", "sighting_of_ref": "indicator--259c8d61-30ce-4814-871f-e74f807d88e6", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11e6d468-c053-44e2-ac38-c1997c363436", "sighting_of_ref": "indicator--3a9301d9-8c67-46f1-8f7e-36a5d463d4dc", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d18269c1-9268-4f41-8a58-466270d71760", "sighting_of_ref": "indicator--e42c0833-3e3e-446a-b649-336dadcec008", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37eed1eb-aa57-4e26-a479-1620a28485a2", "sighting_of_ref": "indicator--48cdf73d-093e-4fff-8be5-aff1820fa807", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfba3fba-b11c-4daa-9149-196fd2acf281", "sighting_of_ref": "indicator--92494ccc-96b7-4cff-a749-544c181e8865", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f42badf4-6d5a-42f8-8c3f-5eca339bc4e5", "sighting_of_ref": "indicator--130c3295-765c-49dc-91b1-17a6b8c9f28c", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8fd2c57-41be-43cc-8991-b1bca84b540d", "sighting_of_ref": "indicator--9391bb83-23b1-480c-a916-debc6108e1f4", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b749bb2-584c-43b0-b33a-d402a9fcf6dd", "sighting_of_ref": "indicator--4dec3442-0994-44bb-9d99-4b2e943fe31e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e53edf61-aa33-43db-b409-63d084446cce", "sighting_of_ref": "indicator--c8ec146f-ee54-4491-9b84-304d44fbcbab", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd49190-d1c6-420e-9462-4bfaabc8e7cb", "sighting_of_ref": "indicator--93708104-457f-4080-b15e-a3ccc2c1b52c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8821ef74-130f-41e1-a205-86c3b46eedca", "sighting_of_ref": "indicator--dd3673dc-0c33-406f-96f2-fb56bf0402eb", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d344b8c0-405c-49b3-a63e-db501dad62e1", "sighting_of_ref": "indicator--093b6e9b-7855-4215-badf-7c5df30a73ab", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c43ae4be-8f0b-4ea0-9b3e-febc94a71938", "sighting_of_ref": "indicator--eb24934b-d945-4d17-a5bf-f0dc92381a02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e78ba8-0e83-498b-9e6a-4880bbb2d9d7", "sighting_of_ref": "indicator--d87fda3b-5935-4951-af22-a694ebfc9a14", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c9f620-f809-487b-9d1e-c8a83db1fa2a", "sighting_of_ref": "indicator--ed1332d4-af1a-4f3a-ae3a-912dd5ca40dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1970825-9dd0-4476-8162-c46b8b7b73a0", "sighting_of_ref": "indicator--f36f3bd5-b3d6-4b87-9588-f14ccd47b4bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b72e98-1d0a-44ee-b2d6-efa8b395cd62", "sighting_of_ref": "indicator--e4b1f804-2b68-4735-888c-bb0ae129e01d", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44c03ee9-6760-4b00-a563-f928e19fbc1b", "sighting_of_ref": "indicator--3fdb4780-7574-4d1b-b7a5-9c4f4c44fba1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2e404ef-6486-4480-b8c3-4c868d7852bb", "sighting_of_ref": "indicator--4cec85ba-e107-45b9-be06-14b65d79a769", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68222e75-e1a3-4187-a235-527c0ce77651", "sighting_of_ref": "indicator--97324bf2-454f-49b5-9cce-5cba9ab8fe5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b14dd5-a362-4760-bf3f-bf5108a27555", "sighting_of_ref": "indicator--b8f0bad9-faea-4543-b874-8a3828a4c80c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb8f22e1-5ab8-4901-a571-86511a163d30", "sighting_of_ref": "indicator--c983c925-f876-4039-ad07-78bfc5836f8c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ac151ff-ce57-49b9-821e-234d7129484a", "sighting_of_ref": "indicator--69a6edc8-1711-49f0-ae02-0895010fa00c", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90310bdb-227d-40b0-96fb-3158c6bcfa5b", "sighting_of_ref": "indicator--4957178e-5b98-4c9b-ace0-4e440e1eaf23", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46778705-4b4b-4afb-a4cf-aa6b5d4ac3ee", "sighting_of_ref": "indicator--2a2b085e-8854-4007-8d1c-736757cb9f63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--511e7d0f-242b-4885-8a86-b209eab52474", "sighting_of_ref": "indicator--6eb50f37-cf73-416e-a345-76b73bc98f7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eac4dda-f658-4d89-925c-73a345a5fb9b", "sighting_of_ref": "indicator--f9a596b0-5a6a-41a1-ba84-c827ca045409", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb1d46c-c5c2-4dc6-a808-7a0753a2004d", "sighting_of_ref": "indicator--34eca7ab-a6bf-4b45-abd4-6905ad4e61bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a28c0392-c8ce-4cfc-b835-8c3c9bbb2ba5", "sighting_of_ref": "indicator--2ef25912-a6ab-4d35-9183-0ab2d839b69a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc30a2e-7a98-4245-a465-e2362180d7ad", "sighting_of_ref": "indicator--036af524-552b-47c7-8b4b-41fad24f3ec5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca2491c2-1a76-4614-8a8e-804ca180b911", "sighting_of_ref": "indicator--a1b06551-3a3c-488d-a72e-7357368c0f08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c73c713-8105-4221-9409-8d2eb4992536", "sighting_of_ref": "indicator--709436df-25f5-470f-b6cf-c18643f83839", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--158d855d-d4a2-4146-9c0a-68e5c563c69f", "sighting_of_ref": "indicator--f2dfe451-a5b9-4919-981e-4fb31cfafad3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaf12d13-115e-4349-b045-061787e57391", "sighting_of_ref": "indicator--ceaeeeed-0051-4217-9c10-2bfe3d523ad2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c36c45f-53c2-44a1-9cbf-c924b9d7c21b", "sighting_of_ref": "indicator--005142ac-0fd2-4693-93bf-5725a832fc77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05753c93-e9e1-494d-ba81-6f7a708f4c91", "sighting_of_ref": "indicator--c25a4627-e398-4ba1-8a65-3791b949de6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1881c3da-e1b9-4706-ad22-870115435a13", "sighting_of_ref": "indicator--0674320d-40e4-4cca-a3ca-7f4c1fcd6fcf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--868caf3e-01a4-420c-8ebe-2f6676040103", "sighting_of_ref": "indicator--552d5fa9-6104-4abd-abdc-4db83607c2b3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84dd7c2b-fe2c-4a39-bd08-1a946056f8ed", "sighting_of_ref": "indicator--cf5ac48b-a654-420a-a410-ac7fbd69adc3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c479ed9-0262-4e6f-bb7f-35f75260418b", "sighting_of_ref": "indicator--94a1375d-7e39-4af5-9dc9-dd826153331f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e2c005-31dd-4548-bef4-ffede15fb355", "sighting_of_ref": "indicator--9120f6ff-0901-48e0-a682-bf6db8f7c7b3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--200d9e89-3432-4aa8-ad3c-c9c7938bdbef", "sighting_of_ref": "indicator--ef6bd01f-83cc-490c-bcd1-4b8418ac7af5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7329fbff-045e-4540-ad4b-2d4f5b91f8b3", "sighting_of_ref": "indicator--672e1038-d300-4238-aed2-a2656e2d0e6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ab6c6f2-43cb-484f-9d23-d294de122125", "sighting_of_ref": "indicator--14811951-4767-4d55-8381-e2e5cb3c44e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f9c660-b2b9-41d2-907c-208fb35e4afb", "sighting_of_ref": "indicator--da04a8b1-349b-4a01-829c-b1d593e3da94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2951d06b-a452-4085-a5ad-fe93f53af69d", "sighting_of_ref": "indicator--836a83bf-b6a0-427e-b63a-a7389a53f5f2", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281519d0-02ce-4adc-820c-3871edd2d5af", "sighting_of_ref": "indicator--c076da77-79d7-405c-b638-440e2ac2880b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e8b6356-10ae-4b4d-9390-4289a4d8ed47", "sighting_of_ref": "indicator--5352be36-8197-49dc-94cc-21d1d32bed92", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f74d7788-892f-4b94-9e83-5e90a64d4a57", "sighting_of_ref": "indicator--9b40e1ab-c05f-4510-8597-1afa0343a46b", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20cd6a2-d8e8-4830-b350-ee5c9125b56c", "sighting_of_ref": "indicator--a823bc9a-07a0-4ab2-b4a9-8801e47815d9", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--085f98e3-e6b7-4275-9872-b1eeee1a6a44", "sighting_of_ref": "indicator--69fcaad3-e1f3-4cbd-991a-8c94d4a2a27b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd944a17-cfc0-47e7-b539-b1c100bc3a96", "sighting_of_ref": "indicator--c5e87940-38e0-4279-99a2-036f3022376a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08058dd2-e19e-4025-a3b4-6e0e7777b3e2", "sighting_of_ref": "indicator--e29c2ddb-aaf6-4317-89fc-403b0a69238d", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05e79673-32e2-48d9-89ad-acc5a9281f7e", "sighting_of_ref": "indicator--245dda5f-0f0d-4cc0-b8a0-ccb4c4d6c4d1", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2fc4488-8cd7-4a07-bc27-b82961a3c005", "sighting_of_ref": "indicator--4ab9fc9d-0e77-406d-b202-9c9720858759", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf6c03e7-a49b-4e3e-bee8-f11e48c8b0db", "sighting_of_ref": "indicator--b18df18d-3897-4bc2-bcb9-877dacf22561", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b024ec4-0147-4f95-a0ed-ad6e70146bf6", "sighting_of_ref": "indicator--82ac4b5b-8db4-422f-841e-915f9519a21b", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2babf5c-7907-496e-a105-1b94cc79ff95", "sighting_of_ref": "indicator--b7b59fd3-1d66-45e1-aab6-1caff905c426", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--402b84ad-c6a2-4d85-b564-64840d8f3ef5", "sighting_of_ref": "indicator--c4131213-298d-4779-b83e-73b85b35dcfd", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e68d45c4-d1b6-4b3c-bfe2-3695207baf57", "sighting_of_ref": "indicator--622378e7-5b3a-4bf0-a64f-28450b50ba6d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6b6053-12b0-4281-a02d-4eb5ee37bde9", "sighting_of_ref": "indicator--c5bc4566-6e8a-4fa9-9f60-63b4bf1a48cd", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ea7493d-29d5-423f-b18d-b4e926b3ee93", "sighting_of_ref": "indicator--23742dff-4edb-408e-b964-7fb548aa9682", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92962268-5ffd-41f3-9b1c-8754abdb8c34", "sighting_of_ref": "indicator--809e1a17-ca72-44a5-ae9c-fd9878944dd9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ecb9328-5251-48a1-8677-8f5ab95b8d73", "sighting_of_ref": "indicator--99d923ea-0d79-4950-b3fd-144717af7517", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b7c143-77f2-482e-a7d9-c4f98c4260d9", "sighting_of_ref": "indicator--59b6b8d2-74c6-4e8e-b816-7dd4f294d606", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d197e25-92f8-463b-a741-b29f0944c586", "sighting_of_ref": "indicator--73782cba-d0d2-4b6e-8693-b97b5fac4a85", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb63eb2-5f98-421b-88c9-8f0d79d4c197", "sighting_of_ref": "indicator--3531b9c1-c25e-403e-8888-e37b124acf5d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1590f3e-ce03-451c-acfe-275e98765e49", "sighting_of_ref": "indicator--7168fd93-b3cf-4de7-bd47-5c90e5c57daf", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d94e3dc-b592-497d-a569-7c25fc64ec10", "sighting_of_ref": "indicator--f8bbf37f-dfc1-4661-88f9-580b7eb69a81", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f21605d-f8a9-4419-8a85-464bf7225877", "sighting_of_ref": "indicator--e69cb7ec-d5eb-41ba-b86a-e1e54ea3482a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c71b7f6-6479-4a55-b947-5a1adfb77d26", "sighting_of_ref": "indicator--34fe23fa-6de6-4e0d-a567-8a0ae25f195d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b9be035-8ed2-45b5-bf03-457aced1f647", "sighting_of_ref": "indicator--f72336f5-509e-4ac4-9ae5-976ce6eb78e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414245b0-00f2-4edd-96b0-2e4eae0d5889", "sighting_of_ref": "indicator--266a040e-2a8b-4ff7-8743-c5835b135209", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f914c06f-0d44-4ce0-b7e9-d4f430d1b24c", "sighting_of_ref": "indicator--5ebd8e03-7a19-4eca-a975-0bcb06eaaf6f", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--043e9e98-7306-419e-9412-d33779833598", "sighting_of_ref": "indicator--9e20d5dd-264a-4aac-9f5c-9bf9b5aea08d", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7877d01-d7df-4bf2-9fa5-aa2406467d1e", "sighting_of_ref": "indicator--8b0bd33e-aad3-4d8c-a14d-227e6eab9127", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74eb6911-7891-4410-a71e-d702d1ddcb10", "sighting_of_ref": "indicator--c7eb37ac-5235-4f9c-8cc7-3d9578f76d0e", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807b4294-1179-491b-b391-3d1605454d8b", "sighting_of_ref": "indicator--6d1071e5-5b17-475d-a4cf-e735ffe3cfee", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d4b325-17f4-4eb8-af55-f10059d9da18", "sighting_of_ref": "indicator--aee3c973-1cd9-44ed-8c3a-38178aca05f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec2a816-9a63-4233-9b1d-ad6eb7549537", "sighting_of_ref": "indicator--db967974-b1e9-4a29-930a-9c6efa130542", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69fc2744-d94f-4ac5-a386-136ecb3281a9", "sighting_of_ref": "indicator--f70d811e-1b87-4d81-8094-beb5daa803b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5effd103-6fea-4054-9a82-561bf3593e80", "sighting_of_ref": "indicator--6feb9706-b5db-4faa-9d01-2342dffbce9c", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcf5ed2e-f42e-4632-8c05-d3701bfe81b4", "sighting_of_ref": "indicator--14eddfd2-3322-4a1f-b01a-bf4e3aee4e3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--014a4a23-4c07-469b-a54b-fa9cb1f0775b", "sighting_of_ref": "indicator--2bce1f4e-a79b-459e-919d-cd5eb8e2c083", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541573c9-405b-4d44-aa07-e596e212675e", "sighting_of_ref": "indicator--c19b751f-6311-49f6-aa65-57561ebb7345", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ce447f6-c068-4ece-82c5-85980ad4edb0", "sighting_of_ref": "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38b0eb22-11ca-4eca-9d22-ee0eb875350a", "sighting_of_ref": "indicator--a07723b4-1c70-427e-8f88-2e0340af9745", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9386812-2c66-4ce6-a9bb-985d9a001c9a", "sighting_of_ref": "indicator--086438b6-d127-4337-a89d-d33851c338bc", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2689ce18-a452-40c9-9b85-956dc54965a1", "sighting_of_ref": "indicator--bc5d85ed-cfb3-4fd1-a6bd-8258ffa4d6b5", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1677ce23-b5e4-4ed8-ad2c-266b1e103dbb", "sighting_of_ref": "indicator--42861668-2925-496e-948e-742d7ab0a73d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--782e6c32-2d27-49d1-ae27-b24d60189d0a", "sighting_of_ref": "indicator--7a75ac03-04f1-4a1c-b9ca-3e74b03ebd3c", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f28314ff-1f2e-4dd4-867a-ae38cbd4d49d", "sighting_of_ref": "indicator--849043a9-5033-466e-b85b-36adcf4931b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72c35de-cb49-4c43-bc08-aa0daccc0457", "sighting_of_ref": "indicator--6b059509-9800-4b02-be9e-ce898ab97c30", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61482124-23a1-4657-ad59-7764dfff6336", "sighting_of_ref": "indicator--28cc44a1-3732-4683-b9fd-a2e6a89e578e", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85d25c29-02e6-4e21-8555-99e7ddf517b0", "sighting_of_ref": "indicator--4774f3da-89be-4aee-bdb4-11ea0fcc33c0", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e04f83c-ccf4-4ba6-9af2-b6f0fe775447", "sighting_of_ref": "indicator--2605deed-8475-426d-ac4d-1cca60f270c8", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44874088-02fc-4b8a-b907-c0968b2298e9", "sighting_of_ref": "indicator--d73c69fa-8f52-425f-a9c8-2d382d89396a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31681f77-4711-4eab-bb04-358e5adb0d87", "sighting_of_ref": "indicator--85302234-f186-4b7d-b157-47571ba60ddb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb269cbc-a31a-4898-b856-c8cf8068d18b", "sighting_of_ref": "indicator--e8f7572c-ac71-4247-80f7-89bda2a88abc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a267cb-d613-42d7-ae7a-5e2b7870304a", "sighting_of_ref": "indicator--2f40807d-e80b-4bed-ac61-eb7c93aedfce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b132359c-f2d6-4631-82d6-2443a1b078df", "sighting_of_ref": "indicator--2b2331d1-f592-40a5-b96f-83688ffb01a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4749fc4e-f61a-4f44-baec-80cd937851b0", "sighting_of_ref": "indicator--e99cc168-d5e2-4948-ba1f-8c44af5b4b08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28971aa4-da48-4073-8081-e0ed309e2aa2", "sighting_of_ref": "indicator--c4618ea5-f1c9-4c8f-9f28-0475aaab1395", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa0e8d8a-dc11-4b6c-8579-1fd8867cd999", "sighting_of_ref": "indicator--f8a89a4f-a23c-4b2e-b826-524539787296", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9321494f-ea72-4652-a17f-c7282d02006d", "sighting_of_ref": "indicator--1eb5f9f4-f4ca-4fdc-b6df-7bdebf2cff69", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8463eb-4927-4496-aeb1-c97790ee8657", "sighting_of_ref": "indicator--41652863-61ee-489f-996f-4f8325d1695b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3a1d0d4-468a-4ae0-9e71-223719e98995", "sighting_of_ref": "indicator--d064ef5b-11eb-456e-8450-e08c4cb49080", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c47ea7a4-363f-48c3-9979-a27802ce983a", "sighting_of_ref": "indicator--5bba9020-8564-40dc-bef8-9075a379b6e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adf86008-bf20-4efd-bda5-3caa4db31dc6", "sighting_of_ref": "indicator--49587720-b528-4af7-b97f-3c73806a0346", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10cfa444-b4ac-4549-8e9e-6c0df2500fff", "sighting_of_ref": "indicator--b11bf8a7-9be6-4aac-bc6e-1677be0a3e96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66f93b17-eb31-458d-bd2c-83a37a4181ae", "sighting_of_ref": "indicator--6c574f9c-99b2-4b2c-96b2-bf2d28423016", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae947a1-cacb-472f-adcb-0a71b6366bbb", "sighting_of_ref": "indicator--2133e271-50de-4c73-8f88-727171e27592", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd1eeb6-105d-4428-b81f-cfec9b2cd0a6", "sighting_of_ref": "indicator--80396a0f-635e-4e51-a864-512923690770", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22d1c82-4aca-4c80-94f0-8e7f3e1f17c4", "sighting_of_ref": "indicator--cdefb32c-5db2-4e93-a054-3deb9a3c6349", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2ef306e-36ee-40d0-9d5c-3dfe970f629e", "sighting_of_ref": "indicator--7ab88b8b-905c-45f5-80ad-530b5c41459f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3a55579-f373-49ff-96f1-8d80115096f8", "sighting_of_ref": "indicator--ea963865-d087-40ec-b987-f1ed7f5b2c2f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--034ede82-1b78-40d0-81ca-2815a5df657c", "sighting_of_ref": "indicator--73933292-556c-4878-b144-260ddaef10e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a69118-d2e4-49e5-8764-28e903e31603", "sighting_of_ref": "indicator--88dfd3a2-ba21-42b6-baf1-48dccaf473ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5bb8e65-4784-438e-b362-7d1ad062a919", "sighting_of_ref": "indicator--3d1b60dc-8136-4f8d-b943-1edadef50ace", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06b08e9-95d3-4b22-abe7-55551c45646f", "sighting_of_ref": "indicator--066173bc-343b-497a-b1d1-dd3b10f6d8b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d48b80-ba74-47b7-9ec5-1492c16012c7", "sighting_of_ref": "indicator--a1b7bab9-2035-4b9c-a523-2f300aad6409", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4b646a-332c-4391-a0aa-8e0d39e98c18", "sighting_of_ref": "indicator--799ac2d9-a234-4a76-ab96-6da75db90fb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16f35924-2ff8-4fd4-af4d-b1fb8d126ac7", "sighting_of_ref": "indicator--307029d0-e4ae-4e9c-b6a6-5eb7790e44ff", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ee863ca-6e8e-4590-a419-e994c606c0ac", "sighting_of_ref": "indicator--5fdc72c7-5edb-45ca-925b-41f75df507d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb8e2c2-6ead-4a5f-8424-0356b4762d20", "sighting_of_ref": "indicator--8f7d0aa7-e6fd-48cf-a06f-9d5d3031088f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ed3b2c6-b0fa-4bf2-bb36-3e5d2703b276", "sighting_of_ref": "indicator--73cfbe05-7714-459a-8d6c-fe4629186f5f", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fbe3e1e-0d0a-43a5-8512-b746960770cb", "sighting_of_ref": "indicator--17f94867-eac0-4489-a9ac-d99f5f6dceef", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90e77b6d-41c3-4cb0-ae22-88e1dc61c1a5", "sighting_of_ref": "indicator--ab19f7f3-fb65-4a62-b03b-505fcf22fd15", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce0afbd-a917-41bd-afac-66d2b46802c2", "sighting_of_ref": "indicator--cf90bc7b-988d-4911-af78-0fbcccc026ee", "where_sighted_refs": ["location--307462f3-345f-4d9c-868a-17a19e3a1c37"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9bb35f5-99fd-48bc-83be-1ac46bf542c1", "sighting_of_ref": "indicator--f11873f3-b08f-4ffb-8050-93308c30290e", "where_sighted_refs": ["location--a16d8aa9-c90d-470f-b91f-2daac2d6860e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f852d0-97ea-43d6-ba32-f579f90f463f", "sighting_of_ref": "indicator--0941a7eb-fbe7-4dc7-8fbc-5c3401764f6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cb3c124-0a87-42dc-9e4d-ba09607daf7b", "sighting_of_ref": "indicator--f13062ba-fa61-426f-ac3a-a2658a8254d5", "where_sighted_refs": ["location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0e9b93e-9fc8-42fc-880a-54cb8c165780", "sighting_of_ref": "indicator--4cfbceb0-009c-4d76-be9c-45f0bd2950e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba3ce1d-5643-4884-bfc1-8a44461a024a", "sighting_of_ref": "indicator--761ca6de-f976-40ee-93b7-59301ecec7d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c788b8-8f79-48c3-add0-9276c1628314", "sighting_of_ref": "indicator--ac8987dc-701c-4f40-b607-59451cd899a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-17T00:00:00.000Z", "last_seen": "2026-09-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--9b104b99-b265-486d-a488-8298e3a69aed", "name": "Threat Report for 2026-09-17", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-09-18T11:00:01.342Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--f481f2cb-cb4f-46d1-a8c6-7ae798026b3e", "location--307462f3-345f-4d9c-868a-17a19e3a1c37", "location--a16d8aa9-c90d-470f-b91f-2daac2d6860e", "infrastructure--4d022866-542e-4224-b2d3-c8acd9fe47d8", "infrastructure--d12936b1-3a00-4dc4-8325-468255dc7393", "infrastructure--d96177ed-b5ab-455b-bfc7-c255e4b9d066", "relationship--fc991538-7441-46ac-874b-f1a2526c2a64", "infrastructure--24b87423-83ce-4b54-98f4-1b5946f9f772", "relationship--2cf4a4cc-a9c8-4215-8459-ee59a85f067f", "infrastructure--921e80b9-b599-4ea8-b7a7-576993b635a0", "relationship--e6985598-5629-4b12-bce1-013ce856b8d9", "vulnerability--c21f79ad-928f-4120-ad91-794b6604fda0", "vulnerability--dada5cdf-e2cf-451c-96e4-40581b1aaf38", "vulnerability--f74c9ebf-b5d0-4848-b026-d778fce771c6", "vulnerability--b823478d-3412-4a91-966e-77714854a18c", "vulnerability--7dbfaeea-5881-4c52-ad93-8652eb9094c1", "vulnerability--621b694b-6375-4c8a-b1f2-85e015b0627f", "attack-pattern--96811c95-6cd4-4ab8-a3e3-41e3543350cb", "attack-pattern--16e96a25-7e00-4ed5-b2cb-a7961037edec", "attack-pattern--efc51ee7-7e9d-4ea4-9757-33a7ddc392be", "indicator--19faabce-04ed-48a6-9e18-38fadfb26432", "indicator--7cd29972-3f39-47bb-a921-839d6ae44e2b", "indicator--472ea49b-6a64-45d0-b25f-a3f3f35079dc", "indicator--adc4f450-2d53-491e-82f1-22caf0b6131a", "indicator--bdf8e20e-ff92-4f8e-887c-87ce314629b0", "indicator--6a1493f6-a16d-4fde-8cf0-819e4709e238", "indicator--cacfbe2a-6af8-43ef-8cf6-696ec151880c", "indicator--8b1b47d1-296f-4f49-b9bc-710e76cb5c39", "indicator--5d1595f7-cb9e-47bd-81be-4417ab123494", "indicator--76456028-641a-49c8-8fdf-a4c72622c9f9", "indicator--7cda04ce-7a62-4f6e-9da8-b2cb4bcd335b", "indicator--7a9bf9dd-1fd1-4522-a6ce-568499ee9e3b", "indicator--2dd65c08-7370-4545-b762-f98fff462b94", "indicator--9b58b7c2-94d6-486c-8cde-ba3329c7f93b", "indicator--e5a5e3ec-9b2c-4231-b6d4-bad5d1ed623e", "indicator--2af10dd8-aa24-464f-9431-04a13c15dcc4", "indicator--ae634394-0f4b-404e-9261-c2d3445d4551", "indicator--90f6022a-9980-4b2a-a5c2-dec79e9a450c", "indicator--336a57c1-35b4-494f-adc4-badce9c6134d", "indicator--15135d32-7959-4709-8983-57cace22513d", "indicator--88bbb85c-af9b-4608-ac74-3696172130a5", "indicator--12c45506-7f97-4da9-a519-6f1f40b0dafd", "indicator--497bf7f9-7126-4196-8909-460314aa71ff", "indicator--72a5f174-fb7f-4fb1-acab-bd9c3de80e12", "indicator--0cdd6a55-4449-4ed2-90f6-d5fc7cb6758e", "relationship--ac652729-3fb9-40f0-a9af-622fd4291a62", "relationship--322a5aa0-ef4d-48e8-bd5c-6e7745170d37", "indicator--16c6838d-da5a-4285-bafb-6cf1b39c055d", "relationship--89fade3f-4cc9-4acd-bdee-77a79342b163", "indicator--2776ffc5-ff34-4a5b-9d98-17c41f97bce9", "indicator--3ee76488-5af3-4dba-8956-a53b62e05955", "indicator--5a31890f-930b-495f-b813-a816e1c6a587", "indicator--6c293527-81d2-46eb-842f-e72f9f3bf379", "indicator--282a86ae-518f-4622-a5f1-bff8b818de89", "indicator--6cf7353b-8342-4c01-97ec-bb9e7d4441ba", "indicator--70c7d69c-f3bd-45bf-a303-8cac1e644ec2", "indicator--ba43be0a-abf6-438b-87ce-67cbd405e16d", "indicator--b4f3aa0f-6347-42dd-b152-fc3f83404b90", "indicator--e74ac4a4-74a6-4345-a2aa-5ff238aa7857", "relationship--3660c4d6-77de-41a0-8ced-eb2d158fd1f8", "relationship--eb5e8a92-3890-4a54-b918-6a0759fcfed3", "indicator--8a7552de-3034-4161-aed9-d063910a7d33", "relationship--5a1ce78a-de38-4101-b9ad-a5caf9bba070", "relationship--c0c5465c-bc2d-476a-b08e-2076ebaee280", "indicator--6591c01d-30a5-43fa-a122-38f1037df446", "indicator--3a16f0a1-df21-41b8-aa7d-dbec1aefa33c", "indicator--bcf3b49f-d7a0-48dd-a08c-25d8e48d9ed5", "indicator--a5aa6b84-70fc-441a-8821-f5d06896bb63", "indicator--5b4b5830-2db8-4416-9fe0-0e6def22a8b4", "indicator--0d404e05-e6cc-429e-9a9d-dbe1d5b1a057", "indicator--a109460e-25bb-4c60-a51e-1f1a76fe9c21", "indicator--c3eb424d-afaf-4b54-96fe-5817b287f63b", "indicator--8beebc54-9868-43a2-9cbb-4c2efc065c40", "indicator--544d85f2-8b26-4968-bd96-097bf5351570", "indicator--227d65a8-d30b-4f97-be78-9222a91c5d33", "indicator--c12f09f6-d986-4ad0-9129-aeb790ca45bc", "indicator--9c82ca3f-b722-4831-91c9-9079f6cfe45f", "indicator--f2b175e2-f9ea-49c4-bf5b-a35ebd921fce", "indicator--29619ef5-8ad4-4976-a763-24682c71e79c", "indicator--647f72fb-73ca-4d9a-89d6-087487e3eb6e", "indicator--fa0274f0-5f5a-484d-8a25-2c14fb86de35", "indicator--ec9a6589-4671-4ee3-8bdc-778bdae7a785", "indicator--9cb8f16a-43dd-4022-86f7-b3541a7a2e43", "indicator--d0000a8a-adbf-4b42-bd3a-4278efa6be4d", "indicator--b097576d-0293-43a6-86fd-0a6adc29696b", "indicator--520b1cf4-a314-4268-b09f-cc835b8bf0e4", "indicator--df77f4e1-f94d-4ec2-9dc6-b4c8d12e5337", "indicator--533bdeef-1fd7-4079-8b3e-bec632882bcb", "indicator--b647e4dd-55d0-4d7a-9e32-25c02a765806", "indicator--b5b136b9-837b-4ef2-9b30-828c4f5d9fd9", "indicator--0efc67af-42e4-4f89-9410-a2e9b4ef6dbd", "indicator--a1a017d6-12fe-4b65-9268-458a6abcbe78", "indicator--ed5c15b0-40ad-4d7f-902e-df12ba0df78d", "indicator--a382175b-8267-4978-81e5-1d33eab703f5", "indicator--a83f753b-4b83-4c10-8428-5edda9137d2c", "indicator--0029a5f5-a032-4fda-8ee4-e1681d65c0ef", "indicator--4ed1b78c-d95d-4d7b-a7c4-145257708e32", "indicator--b1207691-1c82-49a1-bf75-73e8190d0f4a", "indicator--178bc5d3-7494-4dba-91c0-8552ec49a684", "indicator--57c78c28-d7b4-471b-bc7f-81a3073d9118", "indicator--8f81b0f8-aaeb-4fa3-aaf4-65e4936907b3", "indicator--056ebd77-6835-45b4-956a-d8cf80fbb8e3", "indicator--d32a40b8-71eb-4702-a869-c1f017ed8504", "indicator--8315eade-07af-4049-82c3-6b4af25debf7", "indicator--aae72968-5e6d-4c81-85bb-0898cfc1fd73", "indicator--f8edfe6f-2469-4449-a26c-567716384fdd", "indicator--e863beb2-d6a0-4506-a3d9-548bd1db466f", "indicator--463a455a-194d-4a83-ad98-5b27080d4f3b", "indicator--aced55be-7344-4b94-9c32-0bc14c636c79", "indicator--ab2c029b-a94d-4580-a1ec-67587e051bee", "indicator--be7e0dd0-d3b5-48d5-95e9-c40202618c57", "indicator--9a413764-c150-4d6f-9774-434b3e104375", "indicator--53664090-a91f-4911-853f-c7d36ea75ca9", "indicator--b649ee76-c85f-461e-b09d-969f82eaa77f", "indicator--ec35d03f-eb96-4afe-921d-4a1c69d86b5d", "indicator--49f940c2-0f2e-4f07-9adc-e1d50951cb6d", "indicator--56018de6-3a4f-4674-90fe-dca741cc37e2", "indicator--17c7baf6-b3ef-4f42-b6f2-63fd87da7ccb", "indicator--214dfb07-63c3-42ca-8a34-d6564df432c3", "indicator--6bced88f-699f-4094-9ea4-90eeaa1f2ff3", "indicator--c1de2464-71a1-4ee7-9329-f12ef84a0813", "indicator--5661c5fa-f9aa-4d59-bb8c-56308fa9b9c3", "indicator--3b6fd9e4-fb5f-469a-ba7a-bc366fd05b9a", "indicator--64f4e205-d863-423e-9824-48bc42590551", "indicator--9a496dad-7c71-4421-b314-71e548abee1f", "indicator--d74f2c50-0119-44ef-8530-e4398beee589", "indicator--cebfbdae-48db-4535-bfa1-8f246b03fd39", "indicator--35e3d245-9da6-4f4a-9c72-ab5f01b15bef", "indicator--1a62cb1c-d4b0-4a4a-97f6-9e88df4d5123", "indicator--db1c23e3-0f7e-4726-94c0-73aac84f2293", "indicator--68cd63a4-fa97-4345-a3e0-9fccf8eece8d", "indicator--accd775e-07de-4c81-93ae-a308f7b1c39d", "relationship--dfeff35f-a66c-4582-ae4c-c1ff5a667ef2", "relationship--0e1c467d-2742-4640-85c3-532fbe16de17", "indicator--eda3f707-e5fc-4a04-98be-8bbdc46718b2", "indicator--a5a061d4-c82e-4f5c-b485-f08efb885f3d", "relationship--ac21beb7-a547-4d50-b6d1-4c01d7331e57", "indicator--0a015601-bbd5-45bd-8085-aee09f2dcb53", "indicator--2f501970-9e56-4438-9037-5c916b82c29c", "indicator--79a8c1c5-3378-4d28-a1bd-3c30d8c09961", "indicator--25623b70-28eb-4857-9a77-64ecd5360866", "indicator--d77b6bd1-b204-4ff4-83b4-283619596a19", "indicator--81c4a9b7-e554-438e-ba9f-ff10d3898691", "indicator--5ccf894f-0c15-4dc2-9a5d-2b6fa126a40f", "indicator--3eb62f56-ac54-448f-970a-0b0421633c49", "indicator--1340f61b-0267-4d24-83b0-5482071de6d0", "indicator--1d63b962-3980-4ecf-a2bb-e6a606df780d", "indicator--2c65271f-1de6-4d91-b8f2-dada0bab4d11", "indicator--582847fe-87d5-42ed-abfd-ccbfa25d558e", "indicator--cc72324b-bae6-4ef7-b27f-035ac037d60e", "indicator--5ad8de70-3fa4-40c4-9feb-fcf797005737", "indicator--4b392638-3cfd-4e05-bb5b-9dc165e333bf", "indicator--b540a048-a1c1-4e90-b8b2-6798df0cf6a8", "indicator--c008e241-dee6-443a-9b36-93808164551b", "indicator--dc2fe091-53ac-4084-9309-f1736364bb0d", "indicator--e8d3296d-6835-4306-b009-fb5ef88f80d9", "indicator--972e43db-7feb-4014-b199-37276970197f", "indicator--6fc09206-359f-4b39-9475-f728af1dfa5c", "indicator--56542c43-349d-4f2d-91b4-286265418f48", "indicator--2cd8f10c-85e1-4a0e-ab4d-d1529517a35b", "indicator--e0a00155-17b5-4466-943e-dc05772862f5", "indicator--6a06fc11-094c-4a82-8678-80e3cd927007", "indicator--45ef1600-098b-438c-ad20-0b276f9957bc", "indicator--4b310c58-fc78-4f84-90f5-ed00f67c7bae", "indicator--5b91bb97-34da-436c-90ab-f53bd8dded83", "indicator--8a747595-b740-424c-9892-77eb1ac8d727", "indicator--18c2d517-64b4-4652-a94e-fe03ce3d2cd6", "indicator--5154a340-2eee-4fdd-bbce-45820e63cc56", "indicator--0a2120b6-4411-4080-ab31-95790bcc6540", "indicator--1dc3bd29-4fe9-4b99-8dfe-4103f8de82b0", "indicator--aa3013fd-a4f0-4a48-a9ac-9fc2adaf97dd", "indicator--59aa0425-f69a-47a1-86d8-35305df9f541", "indicator--d1ccaa56-9f2f-467f-86c7-742916645dbf", "indicator--ae5575bb-9c22-4f7e-934f-e344717f5ab4", "indicator--1461cc77-87b8-4063-8120-c02f052d3404", "indicator--0d6c643a-a87d-4469-ad84-f85e72a6c032", "indicator--238eceb4-a047-4ca5-ba06-1b494bf7a077", "indicator--07821fe4-a5c1-453e-8ea2-7347fd7d7656", "indicator--1609e935-8673-4ccb-94a3-79aa45c8ec1b", "indicator--5a026d7f-fbb7-4fd9-aa03-4e256ccd43ee", "indicator--0e86c609-b519-48d0-8e50-68155c9841f1", "indicator--cb54e829-0c66-40b6-aca2-4286acf5aaf8", "indicator--617a9309-fd4d-4100-a761-9d275acffb32", "indicator--e0daa716-06ef-4e09-9f2b-d2eaa92cc5a2", "indicator--8f11fe54-cc34-4346-83d9-20d973de2e8a", "indicator--be6726a0-260e-4690-8836-11deab63d27f", "indicator--ff9ce763-ccc9-4f19-8e4e-0f74ba854e3a", "indicator--966ac8a2-0028-46cb-b86d-78fe5af421cc", "indicator--12fc1576-c5e3-4eb7-9800-7799c43139d8", "indicator--fc423e3e-96b9-4457-bc1a-92cf38e80e2d", "indicator--8a65c8db-9231-4a3b-bdce-90e5b5152752", "indicator--9793e3c6-c2f7-4f47-ace3-eda1846f4a29", "indicator--bc65af76-1308-441f-8b6b-0e8e126b7206", "indicator--2840c01f-4fa0-4d92-be21-8523bb2b0fca", "indicator--b0163686-9680-4f63-95b7-8e5e43bed17d", "indicator--b4be7222-caab-4e2d-b7bf-42523d03ab51", "indicator--c3d64583-f228-426a-8dd6-363a61986f12", "indicator--b3daed87-0996-44bd-b90a-9a52e959fcdb", "indicator--7a995725-e6ea-4e28-ba6c-3e3de37e5e31", "indicator--28744707-c435-40d8-b8ca-a8f31e04dd7b", "indicator--fd06a480-afda-417c-ad35-79173cfb2580", "indicator--aae01f26-0c48-40e5-a00b-2fd58c6e2fb3", "indicator--7b84b43e-f42b-4283-bbc2-9c766df82a2f", "indicator--ceff95fe-b0a3-450d-aaa3-6a927f2dceb8", "indicator--541d75fe-9523-48bc-bb23-97018fae07ee", "indicator--0c8e3b07-50fb-43a2-8a35-aa84158f46dc", "indicator--8cb1d5fb-711b-45c1-bcb1-b7e347b5f535", "indicator--251f7dba-6649-40c8-ad5e-1d8f042898f5", "indicator--eaf9a67f-0254-4cae-b8f3-55080081a889", "indicator--f2c79bc2-e21d-4e1e-9e31-3d67e3d26ae5", "indicator--3dbaeb80-6999-4401-ae20-f43335c7dd43", "indicator--8ad1593e-2cd4-4926-9287-f7253a2ecfa2", "indicator--a64cf017-da69-4005-92a5-3754f60fce50", "indicator--fba561fa-6ccc-4624-aa15-f03c246faa8d", "indicator--3d5c29a3-4737-488c-b7ba-ca240f41d166", "indicator--6fe497d3-82c5-4f00-822c-74644a76593d", "indicator--cf6e2b90-986f-4083-b549-36e6face343d", "indicator--61d17c1e-fadb-41be-ab77-c437e3d2c176", "indicator--6a91e359-9257-4b9e-aace-12d39c43a401", "indicator--2c6488bb-882c-4a2e-905f-6f2486195cb4", "indicator--a44afa2f-b5e3-4e73-8a97-4c1d03b58aec", "indicator--373a0780-e301-4696-8ece-bcebfbdc3aae", "indicator--15a97083-6819-490d-909b-05ce479dbe98", "indicator--69419243-90e6-43f4-b676-f68e983f0e65", "indicator--8bcf08db-6d85-4664-86db-0e36228cf9be", "indicator--66283cd4-3727-437c-8313-0ba009e36598", "indicator--79103c57-61c9-40ad-b205-088719425307", "indicator--02d38538-8b19-4145-8312-1909050e650d", "indicator--128be7d0-4ea0-42b3-abb9-c9cc6c09198b", "indicator--4774eabf-ebd2-47cc-bbd5-a43b0e6f1e51", "indicator--02f15a94-904b-43c4-a847-f2f735702ff6", "indicator--1a913f91-0900-42bf-924d-91054d8d3bd7", "indicator--054ee24f-6c71-4e53-8ac3-73da1cc94af4", "indicator--d9433cb2-c788-42af-99d7-3976367b9f71", "indicator--06b95055-ad9f-4c53-9ad6-b6c225301e80", "indicator--0dcc7fb2-f852-4c3d-adfa-571e4afbf420", "indicator--9aafc60b-7345-4dbc-81a3-ef6004e797f7", "indicator--bc3c7b44-b8de-4983-a93c-556a4d734d3f", "indicator--39858d1d-83c7-4dd5-a6b9-199776bcaee7", "indicator--38140695-4518-4fb0-bf02-2284e60712d8", "indicator--1e8ef37c-8837-4668-b20a-edda3b144e07", "indicator--a815a488-fc02-43a1-a45c-9aec0b464184", "indicator--ae98c155-44a4-46b2-9218-87a78afb7725", "indicator--a66c20e5-de61-4f69-b767-ff796b422e4e", "indicator--c55590fb-96ff-44f9-934b-7896d91a7027", "indicator--fea12f57-9b7f-4672-84d5-1cdac2f53a4f", "indicator--be11fbcb-f059-448c-9257-ec75298d25b5", "indicator--5a3de328-3d0d-4f9e-a88e-f150a0b43488", "indicator--26fa9c07-c5d3-4e2c-9c12-5aa2e98da536", "indicator--90c9e3bd-2338-4fed-beaa-66bfa451412a", "indicator--78d0d409-2c42-4fec-8a97-708db7f50a9a", "indicator--c843ff4d-2135-42ae-b5a4-cd84b20c6119", "indicator--eb6d7729-80a7-40b1-bf34-bccd41bae88b", "indicator--3216d7d2-aacd-4ec6-a046-d530fc8de64b", "indicator--30be3e90-4b36-43c3-a8a0-672e8073d7de", "indicator--2589d35d-9a0e-42e1-ad3e-6edab73f3c09", "indicator--58a2e779-e4c9-44be-b972-f896179748d5", "indicator--209276ea-d9cc-448b-8e76-01d370dd5f73", "indicator--9803cd23-ebe5-4b2d-96be-da4582a340db", "indicator--56161186-9d2c-4122-b690-e800a0245b50", "indicator--64b7ac64-3e47-4cee-a70f-b290a2c9c795", "indicator--347be630-8b95-49f1-96ec-74056f1e82d2", "indicator--42463d46-6846-4544-812a-93b6c1e23786", "indicator--bba3a14e-8deb-41d4-bf62-e30ac3b33e79", "indicator--79f130e7-a490-4102-a1ab-eeadbcacb2bd", "indicator--b1cd534a-7348-4987-8f91-e6937b3eb75c", "indicator--df07c313-96d4-4b73-93a2-5a45e92730c3", "indicator--68b1fffa-f093-441d-ba2d-61c80094db2e", "indicator--71bd9f60-3495-4106-a58b-5b2297ed2375", "indicator--927baf6f-6c9e-45d2-ab47-cee726bb5247", "indicator--fa17728a-ee5c-43db-ad75-6aebe780ab7f", "indicator--f3ed568a-377f-4605-b2bd-f77f83ca1adf", "indicator--8db79ad5-d908-4504-bbea-717d5a120f44", "indicator--8efbdbee-07bb-401b-bba3-9b3280669331", "indicator--e63b2bd1-2ad4-4d50-900d-00ca6b036182", "indicator--ad1dbf00-44e3-4354-8cd1-525d27347bf6", "indicator--c1dea3fe-bd7d-4d6b-be6a-9946751a9e44", "indicator--10c7e201-71cf-447b-855c-a0487cf8d749", "indicator--a1179aaa-342b-47f1-80e1-45b8b90090f3", "indicator--e2cfed5f-118f-4828-ab93-00542a72c544", "indicator--8c490aeb-e49b-4108-bdf8-82c7503981a5", "indicator--ab508140-ae07-4198-a7e2-7b54fe5ad869", "indicator--1f4782ce-074e-47b7-a590-f8289e69ecc2", "indicator--fef6225b-0d8a-43d5-9d75-18e5f51a39ed", "indicator--d853aba2-609e-4cc3-b1dd-8c1adf7fa1b9", "indicator--2df5ed9c-4b19-4bf6-b47f-871434a60b4e", "indicator--54b7e83f-a818-44cd-b656-bfe532a69775", "indicator--8627aae9-0c83-4ef0-99a9-a8e229405612", "indicator--33013f81-b98c-4607-8006-5c60dc95a05b", "indicator--6fa94690-e32c-4148-881c-30ed75563bbd", "indicator--a548fd03-d271-4b6b-a343-614c03cd5146", "indicator--cae65ac6-3736-4164-b4cc-d2d7aae784fc", "indicator--46da3562-de82-4231-a084-dd67d88f1913", "indicator--9caa6064-71d1-46ed-b96d-d65a95cee8ab", "indicator--5bf345cf-47e4-47ed-8d49-b9c3700a3ad5", "indicator--4514e0b2-aaa2-423f-b464-82ee3a6c385e", "indicator--5e2c6afa-497d-443a-8e66-578747edb251", "relationship--f7c1a11a-7f89-41de-83c9-d3cd5cb8c4d7", "relationship--ec78e864-c68b-4970-b020-168e1290044e", "relationship--8977492d-6d79-44ed-ac30-959d81f032b1", "relationship--0da8600c-9f59-4f35-86a7-9171f566250e", "relationship--dcc7af7f-24ae-4c8a-a33c-95c1650c01ca", "indicator--d8fadd79-ae7e-4b98-96a8-d91e0b24c94c", "indicator--d5be07fb-4daa-4dff-a279-97daa6d1dd23", "indicator--5e8e0cac-31be-47b3-9d43-4b7ee864a73f", "indicator--68d16904-6005-4453-a0da-0adecc0c9495", "indicator--09fe8c53-04d6-4517-b31c-64254b4c62cd", "indicator--9c15e234-325b-4d37-9cdc-bbed11ef2fee", "indicator--5166f854-f98c-41b9-881c-ffb34371472a", "indicator--216fddca-d673-4da0-afa3-02a874a17d6e", "indicator--2db12dd8-21f8-4e88-a183-1f1eaf795264", "indicator--9f5c8181-c7c4-4413-a0b0-c7b695c1cc66", "indicator--3b56b505-e4f4-4cf6-8885-dfee619e488c", "indicator--3fbf1fae-dbb9-41d0-b518-00064d39c7c1", "indicator--84958e64-d513-4042-8c85-45b2bc3c135c", "indicator--7489a4fc-6067-40c4-8546-1564e5434905", "indicator--eeb10e05-5ec2-4aae-af5e-4f13e22f8ecd", "indicator--92a5343f-0db1-4ee4-bd05-2efbb67172dd", "indicator--16cc8c8c-0953-4a7c-b8ec-f48d23cbccb6", "indicator--fccae0ab-e725-47fb-ae44-808e83def3a4", "indicator--8869bbeb-9bf9-4ca0-923b-248b5ba0e0b1", "indicator--2b265ec5-48ef-46dd-897b-7d038158c77d", "indicator--52d84a24-dfc0-4e9b-aff8-c59b00d4e7f6", "indicator--55889582-099b-4c7f-b069-a1e1f098099e", "indicator--0517ce65-41b2-4bb3-ba3a-a1760a45cedb", "indicator--b6167153-373c-4062-b1a1-45d9f2d2ce3f", "indicator--f612ea4a-0bfa-4a81-8958-1f32822bcf55", "indicator--05a2c58f-2b9c-4431-9cfd-46f77097affb", "indicator--4c5935b1-cf4b-4747-9cf9-0a11e1006507", "indicator--2b2e034a-5ef8-4a35-9a81-6ff87ca274e4", "indicator--19322f82-6f5c-44c4-b17c-a0234bf73d4c", "relationship--c1e3051a-c194-416f-a7e8-c51eb6117308", "relationship--53dfba0c-e454-44fb-8020-d5edd4bc0e2c", "relationship--55e7e776-38fd-4e67-988a-bee2b93d3d61", "indicator--b27e78fe-4366-4a1d-911b-48de95a746ac", "relationship--c1224a76-4eb8-4171-905f-24db900e148c", "relationship--c27142f6-f2c1-4c17-b4d5-6eaab0a5fdda", "relationship--d05b8af6-aadb-4371-9a9d-700339c07bf6", "relationship--703ef944-9083-493b-b70a-3af00a52329f", "indicator--fb84fea3-1a4f-49ab-9eb2-d6729f032098", "relationship--cf6b21ff-8455-4f60-b596-950af6b8c20f", "relationship--8d55ef87-3664-4a35-b641-5c8cdb83a696", "relationship--4782e558-58b1-4172-adc8-321a07d8d523", "relationship--e13a97fb-ff4b-4244-a1c8-529121968f3a", "indicator--9423b1d9-21d2-4206-8cee-8c1a4f0c5a9d", "relationship--c838b062-ea2e-4c5b-abe7-8e45d1efee83", "relationship--d14dd551-97f7-4a72-a99a-15545f2da6d0", "relationship--318f757a-5c57-4120-8883-247c5d50f9f1", "indicator--191c5709-10c8-418a-aafe-bba5e932df32", "indicator--a5dc93ad-fab3-4dde-82fc-b5b4381064e6", "indicator--3f8ea8fb-1d84-4c71-b465-3b575e13a7e9", "indicator--e76ca79a-ba10-4132-841f-fce4b8ff1671", "indicator--38d645d8-fe0b-490f-a523-80615877e14d", "indicator--e6e9d880-7451-4ec5-8512-c02239723fff", "indicator--c1ce8126-9af0-4d2e-b3fd-4e53d3dc170f", "indicator--1d27482c-1c26-40ee-bb62-efc9ff2fef62", "indicator--39832c21-ed94-4d9e-8492-6875a6fc2dcb", "indicator--bfb9a84b-74de-412c-9fb1-f1fbfe5ae4d4", "indicator--05ab9338-3cf5-4501-b3db-88defa390950", "indicator--3d6cb07f-501c-457d-93bd-46bc58730121", "indicator--80770f02-fb04-4c7b-87fc-08550b473429", "indicator--7ec69f05-11a0-4cac-851e-d31babe44dd5", "indicator--223c8ebf-d4d3-4f63-90b9-db8bdfd3eff7", "relationship--8ba24508-1d2e-40a6-a85d-4c29162928f7", "relationship--81bed110-565d-4c7b-bb3d-70569374fb07", "indicator--3eb1c24c-2d3f-4a42-9f51-de62aedd96de", "indicator--e894524e-eb26-4bb6-8336-f204dc6dd441", "indicator--ba40d5b3-f9f8-4b0b-ac18-033bc73836bd", "relationship--e340464f-0edc-4f43-83e5-38b21052069c", "indicator--0d6c0bce-bf65-4127-8a8a-b2b210273008", "relationship--029b5dbe-8853-456a-84d2-5050b26a340a", "relationship--5afb4daf-5d8e-496f-8062-20c65912e567", "relationship--0e0b03ba-242b-4183-b3f9-5eec86e7b556", "relationship--c6db6b62-886f-452f-8f37-291af8d00ac6", "indicator--a3407590-910c-4342-840f-9b74eaf9f0f8", "indicator--39b87c43-18c1-40db-92db-dfc55c495206", "relationship--0d3fbe3d-c1e0-4f4e-8c7f-f259b8af365c", "relationship--7e3672c1-6248-4207-87c3-0162a1bbacc3", "indicator--727489b8-2edd-4fa8-80b9-d14d3f322350", "indicator--45768ba0-2c74-4c87-88e6-1be62ce705c2", "relationship--22718cce-7577-4823-9e11-2ce557e69791", "indicator--7c86f8d3-02db-4cd8-8e60-21f8697181fd", "relationship--67192102-0776-404a-899b-5916b9177d6f", "relationship--b2fb60f4-99a1-48f7-a807-6b86f5ceeec3", "indicator--b2d2be9a-76e7-49ce-a0e5-b729e765d6b4", "indicator--a8a8594b-2e51-4782-ba62-3a4ed251498c", "indicator--80767eb9-3941-481e-b875-d71e220191a9", "indicator--0dc37f79-bb23-4d0e-adee-a53fcf590efe", "relationship--8a2640de-9dc6-48ba-829c-e1d56254aa18", "relationship--aa4b0af6-9749-4f8f-8a49-c334b0419364", "relationship--395ff326-87d6-4a30-9db4-9f6a56181f09", "relationship--b00afdc3-3c6a-4173-b5d7-c235abe39b69", "indicator--320045aa-9a52-441e-bbee-57222a98bf6e", "relationship--c8ad2991-7461-46be-b60f-7bf4e330cccc", "relationship--1a270524-301a-4d2d-bdaf-2598e8e8f287", "indicator--54281e82-d7df-4e65-88b7-3284bd6a88b6", "indicator--0cbdb823-e5f9-466d-a7f6-2782c58a8d1c", "relationship--0f4020ef-1bf6-45d6-942c-56a01394ee82", "relationship--acd570cd-b15a-45f7-999c-d3de1134f885", "indicator--720f9039-2366-438f-aac8-9e749bbfa2f1", "indicator--63c25740-7269-4dd2-8030-09b5cf401c59", "relationship--520ed925-124d-438f-a5fe-6bfca8d4407b", "relationship--03305de6-b2cb-424b-b418-76bf07832170", "relationship--18cf30bb-2c8b-4509-a7bf-5c7ee78deb5b", "relationship--c7e6477a-d500-4f73-9fba-10fd31c2e4c8", "indicator--1059aa62-97fb-4b62-81de-aafd0401087a", "relationship--b8ff48e6-9865-4a81-a8bc-dd3c846b9cee", "indicator--ff6e6c98-400b-43cc-8639-dd352766c75a", "relationship--6cac0fc6-5da3-4cdc-987d-e0eaedea6891", "indicator--29811871-443f-45c5-9b35-bc18a53f751b", "relationship--da04fbea-f176-4c1b-aae5-aa3e0a7204a8", "relationship--c1d04083-6f7c-4829-88a6-af07116e5917", "relationship--0f41677d-c04e-4658-970b-41de6d0c8e92", "relationship--3afa7a7a-f85d-40db-a677-e0636d58d9ba", "indicator--371d9026-7bc9-4f50-a3a4-775da188f507", "relationship--a91e10af-4619-4a88-a0dc-97ab9dfb4b16", "relationship--a8ac1cfa-250a-4855-904f-090caf379172", "indicator--e62e1cfc-5c54-461c-bb29-47de4dbd3ee6", "indicator--432514bf-1998-4e54-b680-87296821dfa4", "relationship--3522cb24-eb29-4ca2-8bee-1fdb8b4f9c3b", "relationship--a36804c7-96f5-40f0-b770-cf8668ee9ea8", "relationship--5562069f-d0b0-4371-aad2-512112e56c19", "relationship--12a3785c-28a1-4e4e-b0cc-6ea36dfc4892", "relationship--623e5444-7bac-489e-8988-cb817593a5f9", "relationship--757c1034-79e0-47ee-abc5-4b83c695d109", "indicator--e44b7933-b5d7-4343-9111-5d23a591a818", "relationship--95802895-2b7d-44cc-9182-4709435d8c34", "relationship--67730189-ec34-4a3c-9141-bc0f15205835", "relationship--4154f47a-6de8-4d1f-903b-391dbe85af6b", "relationship--da524a19-a788-47ea-83b2-55c3ee6db25e", "indicator--cbcf667b-b40d-429d-90e4-848eadddb301", "relationship--2c36a7db-0e60-4ca3-bbeb-7a8df93c8244", "relationship--10414b8b-ff21-414a-957d-89c04688b679", "relationship--b9b5a055-640f-4412-994a-bac841f199cc", "relationship--e160898b-d8c5-4dd8-84eb-f51ae3777701", "indicator--6193c6f3-219c-4020-a0d9-2b706d9e6df6", "relationship--d1dd6282-067d-49d5-88c2-478a5e010452", "relationship--bdefe78f-1c1c-43c0-9c07-da2f105b465d", "relationship--daf01acf-2bfb-4ebb-b8c7-8d6135587c29", "indicator--b12a28aa-d4d0-4c41-a27e-d1d9f22540de", "indicator--76dbb022-a92c-4f7a-aadc-1ce2ce79f3a3", "indicator--bb5f6071-e33b-4b4e-a7df-54582d1c1ccb", "indicator--7cbfe2aa-c405-401d-87cb-647a414bf315", "indicator--4ec09ee7-5fab-4981-9015-6950ee75de8e", "relationship--fa3cb80a-022f-4be4-a688-5709a138ac54", "relationship--e70524ac-b886-4115-9a4c-e8b4c4182c7f", "relationship--963e66dd-4403-49fd-89f1-2f5cc7437ddd", "relationship--3c608235-97a1-47ad-9ec5-9b2b4c28c8cc", "indicator--1bafc03f-1b2e-4c10-a9ca-afea3fbb87dd", "relationship--ee6b316b-ae65-436e-a41d-bb2701dec727", "relationship--0c49014b-7cca-4d6e-8bab-d33c6dd41624", "indicator--9313eda6-6eb4-49c8-a7d6-582b0ac65ad3", "indicator--bb810d13-1d72-4037-9f84-fb4b3c1b6c0e", "indicator--f9927899-48cb-4af4-8fe0-7bc17bf549f8", "indicator--73e8639a-393d-4a10-975f-9faa9d646759", "indicator--7800d8de-c47d-4895-9140-0b4ea6a5825a", "relationship--0f30b4fa-32d6-4da7-b69c-26c250f7535f", "indicator--be5ddd2d-dddf-4d34-817e-cc1515afabd0", "relationship--fbe84e03-a3e0-439c-8cdc-e6f12df4d0e5", "indicator--e70b9712-4a1e-470e-bdf1-11d58cdb4b83", "indicator--f1f1cc8c-6c0b-4c28-9188-4ae6b249106c", "indicator--f102c45a-0480-4cf0-9586-b591c80624d7", "indicator--86be901b-daf9-4eec-9664-642438c79dfd", "indicator--d18bee91-62d9-446c-8ba7-0906618c63b2", "indicator--8dff9e4b-efaf-4a28-af6f-bdf391009eb7", "indicator--e94e2222-bb3f-4367-a6df-34bf583cc919", "indicator--30255714-bd56-44dc-810e-60ce8736dac2", "relationship--acdcd32f-9143-4515-b230-95d4e2763e9a", "relationship--424eee9b-ea93-4621-9065-40dbbee00022", "indicator--5086a3fc-0bcf-49f0-bd28-3d21b93773be", "indicator--d717181c-e61e-4c15-806c-81187ca1fc4d", "indicator--bc7a905c-2338-400e-b770-35a39795fe46", "indicator--0093ee09-caf8-4d89-9392-866db1598a1b", "indicator--45b03561-a129-41ac-9507-5132440721d4", "indicator--4d5e1d28-df1f-4fb7-a216-fbb6f0dfc1e4", "indicator--761029a2-00e1-4c15-b4ca-a388af57dbc4", "indicator--1e1efa34-fd1f-4980-ace4-cd1814c9e62a", "indicator--5075d238-85ac-4e04-af11-873b00d4f7dd", "indicator--58c488bc-6b43-41b5-96f2-bca25d64b9cc", "indicator--427f6cf7-acc3-46c1-9f49-eb27c4ace034", "indicator--615be48a-86ff-4001-ae6b-42b4aa24b91d", "indicator--f3a74d88-fec3-4d6f-8bb5-514000d52550", "indicator--f0667ab5-b879-4015-8a2f-215ff7003e53", "indicator--fff93e92-f7b5-4459-8654-f8cd04c03e81", "indicator--5fa1da65-68a3-40e9-a744-5450a4c44433", "indicator--9c5a702c-3b0c-4b5c-8b55-773914fdb51f", "indicator--aed41e06-5483-44ef-928f-86a35c0a8167", "indicator--49fa2b52-1ae4-4470-90cf-413f990c922a", "indicator--7b546675-0954-4484-ac0a-a4f44b8de0e3", "indicator--a01ec627-ea3a-4e2b-9173-9428def57413", "indicator--355bcf30-ee75-4ef1-9909-22c67f77f056", "indicator--503fa007-9fde-498c-bca8-2c37df15f751", "indicator--f07b4177-8640-428e-a384-76d63b5b141f", "indicator--e27ed6ae-50f3-4cfd-bd6e-c1004ce80b07", "indicator--7926e513-0810-454a-bafa-c22ea3c6c682", "indicator--a6ac2dcb-f26b-4163-ba2d-f822e3d8a9a4", "indicator--ae25f092-edd6-4bff-8686-a6d58f6b3793", "indicator--bfe4cb17-83fd-4eef-8067-57d2acc0d740", "indicator--ea8fe99f-f77e-4e1a-872e-84979e4cffce", "indicator--af12abee-3ff2-4129-9658-a8ce3f309f62", "indicator--1d246071-a625-474d-ae1a-bbe679251c62", "indicator--8acfcebe-01ed-45af-882a-160974842142", "indicator--defda975-445b-480d-917c-eb9748ca6f1f", "indicator--7e5c8eab-c080-49df-b98e-0ff2076dce45", "indicator--43876cd8-b97d-48a9-9320-5935326f25b5", "indicator--12433258-e181-499b-9a31-62ba7ef435fc", "indicator--6da5d45f-0149-407e-89e4-b926cb9c32d9", "indicator--d89dc6bd-af69-46b0-8c06-55cfebca8325", "indicator--1d5fe841-903f-4363-b05c-cc61c9bb97cd", "indicator--b00f9057-b904-4487-93d4-57ee2ac3657f", "indicator--d28254c3-3e6b-4086-9708-4e08d9b2aad2", "indicator--b44d1573-1484-46bc-a496-45865003f635", "indicator--e1e34648-569b-4054-9ece-07544debfaff", "indicator--7645da11-69b5-4cf5-91c0-963a58346d76", "indicator--ae60a890-2055-4abc-8c82-fda639dee084", "indicator--9ff4f147-ffea-4648-830c-7737b8b9916e", "indicator--f34a0cf4-ddb1-4196-b740-80be6a47af7b", "indicator--3b0e8d8e-95f8-4991-a710-a4ca3983f550", "indicator--c8371542-19a8-4434-9122-241b091160ee", "indicator--025a55f8-662f-4789-9f8d-622eb08d8f47", "indicator--fa0f22dc-5f2f-49e6-a3f9-bdbbb3d6f108", "indicator--0efa5431-e997-4038-afb3-ab20f6e35ce0", "indicator--8a39b54b-098d-4836-ba10-95acdeed4f55", "indicator--064ed2ee-8386-4d06-b167-2227e7279bbf", "indicator--4659c312-101c-4d09-8789-4e7b9f127027", "indicator--d9cd1ba6-79e0-47d4-9596-39aac69c936e", "indicator--d64ec72a-e6a5-4c9e-a09a-73909247d7d2", "indicator--80312726-c105-4b12-9d1f-78534b9f7026", "indicator--a8402905-8919-4c53-859f-c8140600c537", "indicator--dd5043b1-2c2b-4a39-b537-27b69864217c", "indicator--d944c95d-41d7-4f92-adbc-dd44f6e7f348", "indicator--8d4b2247-7ebe-416b-9826-ffe528a852ba", "indicator--ea6514e8-c313-46e6-8a33-3622fe530649", "indicator--7b2e02af-3991-40d0-b8d6-08999ec2cdb0", "indicator--07f4893b-692b-463c-a7af-2728da70a84b", "relationship--8611d885-335a-4784-bcc9-c02030591955", "relationship--ec8a0065-baf5-4728-b063-fbba4762e000", "relationship--4815325a-9b3c-4504-b4ca-9ebdd39a1e41", "indicator--5578a61a-712b-4ad3-a6b1-ec45f56a7ee7", "indicator--3abdeff4-e9cf-4f33-97f4-614454536be6", "indicator--11b4d9ad-27f2-4038-b41a-735d725d6853", "relationship--b4ce19b4-7870-4aa1-801f-ea650a125227", "relationship--7cfe97d7-738e-4ca1-b90c-011df25f1e66", "indicator--81a3078b-027e-4a7b-9bd6-46ec0a93ca93", "indicator--dcd5541a-a436-4973-b3b3-7c0eb86eeed7", "indicator--133fca3b-7b10-480d-a5d5-20e851f1bf73", "indicator--f9f813af-72e0-49b5-8cd6-b905668ec20e", "indicator--2f88eafd-59c8-4b4a-9af0-0d49f1da01cd", "relationship--f8405406-7227-4720-b463-65b0ba28bee2", "indicator--fc01f9f0-d096-4a7e-866e-53013addfeda", "indicator--f49d71a9-54d4-43b5-bfbe-7028d00fff2d", "indicator--9d87e9ff-e4ab-4969-becd-b9aebff34f00", "indicator--f373dd2f-22d2-4c5a-8cbc-8946d5af1aef", "indicator--f55281d1-aa3a-427d-9083-99f359f87063", "indicator--6cf1edf7-3ef0-4a2e-b17c-f73b9fe67c9b", "indicator--d596d539-1dc1-4877-acbd-73b350da542a", "indicator--2d0ca396-8243-4fc4-af14-2f4758ecd183", "indicator--c944c276-d46c-4194-b21b-2c2fbedae370", "indicator--1c061882-08d9-451c-b76b-e7ce041ea82d", "relationship--79938c0b-6c56-4d7b-b886-4355abb38a63", "relationship--013de45d-8d0b-4565-b5cf-f7e5e07a107c", "indicator--259c8d61-30ce-4814-871f-e74f807d88e6", "indicator--3a9301d9-8c67-46f1-8f7e-36a5d463d4dc", "indicator--e42c0833-3e3e-446a-b649-336dadcec008", "indicator--48cdf73d-093e-4fff-8be5-aff1820fa807", "indicator--92494ccc-96b7-4cff-a749-544c181e8865", "indicator--130c3295-765c-49dc-91b1-17a6b8c9f28c", "indicator--9391bb83-23b1-480c-a916-debc6108e1f4", "indicator--4dec3442-0994-44bb-9d99-4b2e943fe31e", "indicator--c8ec146f-ee54-4491-9b84-304d44fbcbab", "indicator--93708104-457f-4080-b15e-a3ccc2c1b52c", "indicator--dd3673dc-0c33-406f-96f2-fb56bf0402eb", "indicator--093b6e9b-7855-4215-badf-7c5df30a73ab", "indicator--eb24934b-d945-4d17-a5bf-f0dc92381a02", "indicator--d87fda3b-5935-4951-af22-a694ebfc9a14", "indicator--ed1332d4-af1a-4f3a-ae3a-912dd5ca40dc", "indicator--f36f3bd5-b3d6-4b87-9588-f14ccd47b4bb", "indicator--e4b1f804-2b68-4735-888c-bb0ae129e01d", "indicator--3fdb4780-7574-4d1b-b7a5-9c4f4c44fba1", "indicator--4cec85ba-e107-45b9-be06-14b65d79a769", "indicator--97324bf2-454f-49b5-9cce-5cba9ab8fe5c", "indicator--b8f0bad9-faea-4543-b874-8a3828a4c80c", "indicator--c983c925-f876-4039-ad07-78bfc5836f8c", "indicator--69a6edc8-1711-49f0-ae02-0895010fa00c", "indicator--4957178e-5b98-4c9b-ace0-4e440e1eaf23", "indicator--2a2b085e-8854-4007-8d1c-736757cb9f63", "indicator--6eb50f37-cf73-416e-a345-76b73bc98f7b", "indicator--f9a596b0-5a6a-41a1-ba84-c827ca045409", "indicator--34eca7ab-a6bf-4b45-abd4-6905ad4e61bf", "indicator--2ef25912-a6ab-4d35-9183-0ab2d839b69a", "indicator--036af524-552b-47c7-8b4b-41fad24f3ec5", "indicator--a1b06551-3a3c-488d-a72e-7357368c0f08", "indicator--709436df-25f5-470f-b6cf-c18643f83839", "indicator--f2dfe451-a5b9-4919-981e-4fb31cfafad3", "indicator--ceaeeeed-0051-4217-9c10-2bfe3d523ad2", "indicator--005142ac-0fd2-4693-93bf-5725a832fc77", "indicator--c25a4627-e398-4ba1-8a65-3791b949de6a", "indicator--0674320d-40e4-4cca-a3ca-7f4c1fcd6fcf", "indicator--552d5fa9-6104-4abd-abdc-4db83607c2b3", "indicator--cf5ac48b-a654-420a-a410-ac7fbd69adc3", "indicator--94a1375d-7e39-4af5-9dc9-dd826153331f", "indicator--9120f6ff-0901-48e0-a682-bf6db8f7c7b3", "indicator--ef6bd01f-83cc-490c-bcd1-4b8418ac7af5", "indicator--672e1038-d300-4238-aed2-a2656e2d0e6b", "indicator--14811951-4767-4d55-8381-e2e5cb3c44e4", "indicator--da04a8b1-349b-4a01-829c-b1d593e3da94", "indicator--836a83bf-b6a0-427e-b63a-a7389a53f5f2", "indicator--c076da77-79d7-405c-b638-440e2ac2880b", "indicator--5352be36-8197-49dc-94cc-21d1d32bed92", "indicator--9b40e1ab-c05f-4510-8597-1afa0343a46b", "indicator--a823bc9a-07a0-4ab2-b4a9-8801e47815d9", "indicator--69fcaad3-e1f3-4cbd-991a-8c94d4a2a27b", "indicator--c5e87940-38e0-4279-99a2-036f3022376a", "indicator--e29c2ddb-aaf6-4317-89fc-403b0a69238d", "indicator--245dda5f-0f0d-4cc0-b8a0-ccb4c4d6c4d1", "indicator--4ab9fc9d-0e77-406d-b202-9c9720858759", "indicator--b18df18d-3897-4bc2-bcb9-877dacf22561", "indicator--82ac4b5b-8db4-422f-841e-915f9519a21b", "indicator--b7b59fd3-1d66-45e1-aab6-1caff905c426", "indicator--c4131213-298d-4779-b83e-73b85b35dcfd", "indicator--622378e7-5b3a-4bf0-a64f-28450b50ba6d", "indicator--c5bc4566-6e8a-4fa9-9f60-63b4bf1a48cd", "indicator--23742dff-4edb-408e-b964-7fb548aa9682", "indicator--809e1a17-ca72-44a5-ae9c-fd9878944dd9", "indicator--99d923ea-0d79-4950-b3fd-144717af7517", "indicator--59b6b8d2-74c6-4e8e-b816-7dd4f294d606", "indicator--73782cba-d0d2-4b6e-8693-b97b5fac4a85", "indicator--3531b9c1-c25e-403e-8888-e37b124acf5d", "indicator--7168fd93-b3cf-4de7-bd47-5c90e5c57daf", "indicator--f8bbf37f-dfc1-4661-88f9-580b7eb69a81", "indicator--e69cb7ec-d5eb-41ba-b86a-e1e54ea3482a", "indicator--34fe23fa-6de6-4e0d-a567-8a0ae25f195d", "indicator--f72336f5-509e-4ac4-9ae5-976ce6eb78e2", "indicator--266a040e-2a8b-4ff7-8743-c5835b135209", "indicator--5ebd8e03-7a19-4eca-a975-0bcb06eaaf6f", "indicator--9e20d5dd-264a-4aac-9f5c-9bf9b5aea08d", "indicator--8b0bd33e-aad3-4d8c-a14d-227e6eab9127", "indicator--c7eb37ac-5235-4f9c-8cc7-3d9578f76d0e", "indicator--6d1071e5-5b17-475d-a4cf-e735ffe3cfee", "indicator--aee3c973-1cd9-44ed-8c3a-38178aca05f3", "indicator--db967974-b1e9-4a29-930a-9c6efa130542", "indicator--f70d811e-1b87-4d81-8094-beb5daa803b6", "indicator--6feb9706-b5db-4faa-9d01-2342dffbce9c", "indicator--14eddfd2-3322-4a1f-b01a-bf4e3aee4e3c", "indicator--2bce1f4e-a79b-459e-919d-cd5eb8e2c083", "indicator--c19b751f-6311-49f6-aa65-57561ebb7345", "indicator--aa083297-aabf-4764-9fe3-d54a2bfb24bb", "relationship--06ca3903-fc12-4358-8c31-a3aaf93c166e", "relationship--e2f5d1a7-7882-4383-ad54-54ae6b5b7317", "relationship--e9a89faf-6bf0-4713-bd01-4d2ecdc3e249", "relationship--d5a1abb6-a789-49ab-9a81-164e5ea3b950", "indicator--a07723b4-1c70-427e-8f88-2e0340af9745", "indicator--086438b6-d127-4337-a89d-d33851c338bc", "indicator--bc5d85ed-cfb3-4fd1-a6bd-8258ffa4d6b5", "indicator--42861668-2925-496e-948e-742d7ab0a73d", "indicator--7a75ac03-04f1-4a1c-b9ca-3e74b03ebd3c", "indicator--849043a9-5033-466e-b85b-36adcf4931b2", "indicator--6b059509-9800-4b02-be9e-ce898ab97c30", "indicator--28cc44a1-3732-4683-b9fd-a2e6a89e578e", "indicator--4774f3da-89be-4aee-bdb4-11ea0fcc33c0", "indicator--2605deed-8475-426d-ac4d-1cca60f270c8", "indicator--d73c69fa-8f52-425f-a9c8-2d382d89396a", "indicator--85302234-f186-4b7d-b157-47571ba60ddb", "indicator--e8f7572c-ac71-4247-80f7-89bda2a88abc", "indicator--2f40807d-e80b-4bed-ac61-eb7c93aedfce", "indicator--2b2331d1-f592-40a5-b96f-83688ffb01a0", "indicator--e99cc168-d5e2-4948-ba1f-8c44af5b4b08", "indicator--c4618ea5-f1c9-4c8f-9f28-0475aaab1395", "indicator--f8a89a4f-a23c-4b2e-b826-524539787296", "indicator--1eb5f9f4-f4ca-4fdc-b6df-7bdebf2cff69", "indicator--41652863-61ee-489f-996f-4f8325d1695b", "indicator--d064ef5b-11eb-456e-8450-e08c4cb49080", "indicator--5bba9020-8564-40dc-bef8-9075a379b6e3", "indicator--49587720-b528-4af7-b97f-3c73806a0346", "indicator--b11bf8a7-9be6-4aac-bc6e-1677be0a3e96", "indicator--6c574f9c-99b2-4b2c-96b2-bf2d28423016", "indicator--2133e271-50de-4c73-8f88-727171e27592", "indicator--80396a0f-635e-4e51-a864-512923690770", "indicator--cdefb32c-5db2-4e93-a054-3deb9a3c6349", "indicator--7ab88b8b-905c-45f5-80ad-530b5c41459f", "indicator--ea963865-d087-40ec-b987-f1ed7f5b2c2f", "indicator--73933292-556c-4878-b144-260ddaef10e2", "indicator--88dfd3a2-ba21-42b6-baf1-48dccaf473ee", "indicator--3d1b60dc-8136-4f8d-b943-1edadef50ace", "indicator--066173bc-343b-497a-b1d1-dd3b10f6d8b0", "indicator--a1b7bab9-2035-4b9c-a523-2f300aad6409", "indicator--799ac2d9-a234-4a76-ab96-6da75db90fb8", "indicator--307029d0-e4ae-4e9c-b6a6-5eb7790e44ff", "relationship--beceb0d0-cd6e-4656-87af-8f3dd3f25cde", "relationship--e2e3b178-ed52-49a0-a22b-e747811a56ab", "indicator--5fdc72c7-5edb-45ca-925b-41f75df507d0", "indicator--8f7d0aa7-e6fd-48cf-a06f-9d5d3031088f", "indicator--73cfbe05-7714-459a-8d6c-fe4629186f5f", "indicator--17f94867-eac0-4489-a9ac-d99f5f6dceef", "indicator--ab19f7f3-fb65-4a62-b03b-505fcf22fd15", "indicator--cf90bc7b-988d-4911-af78-0fbcccc026ee", "indicator--f11873f3-b08f-4ffb-8050-93308c30290e", "indicator--0941a7eb-fbe7-4dc7-8fbc-5c3401764f6b", "indicator--f13062ba-fa61-426f-ac3a-a2658a8254d5", "relationship--1e74ee19-058c-4d26-a0d3-f8fb07a0901b", "relationship--ebddc426-d36c-4873-8542-d8f76d3a4caf", "indicator--4cfbceb0-009c-4d76-be9c-45f0bd2950e1", "indicator--761ca6de-f976-40ee-93b7-59301ecec7d3", "indicator--ac8987dc-701c-4f40-b607-59451cd899a6", "sighting--1326ff94-2b90-477a-a439-7da834e7ccf3", "sighting--6f9a138d-70ec-48b4-b666-8cae35ca8b6f", "sighting--1a46b896-b3f0-49ed-b70e-dacf872f705e", "sighting--06e72f86-3205-4d6a-8353-8f1e2dd3926b", "sighting--4357c0fd-50bf-4326-aa2c-3ff2c58fb34c", "sighting--8adcb386-5e1d-4a12-a907-dcc90901a2c6", "sighting--5172f5cb-8cc8-4cfb-bb24-61f666d02212", "sighting--513e604c-6222-4cb7-a6bb-64b4af577a87", "sighting--d7dea7d4-6b35-4a5e-aff8-4d22f2858bb4", "sighting--75000661-80a9-4f14-b294-e0ce027e45ca", "sighting--1897e5b6-2b38-408e-9f6c-fb8241fccdc4", "sighting--1ab3e8c5-fe63-4af5-b068-b0c56ac07fc2", "sighting--0fb361c0-2cff-48f0-9bbe-6caf2330c9b5", "sighting--1266480b-6a52-4e6d-a126-a423bcf8f7e0", "sighting--39772ef4-1e13-47ad-8d68-49c689e22d5c", "sighting--99336668-02cd-427a-81e1-3c5c21067391", "sighting--3c239693-3fa8-4e8e-838a-6113a458a122", "sighting--98ecf9c1-095d-4794-90c6-c9b437e52296", "sighting--81de6cce-773f-4df2-9d18-5a9be03dea6b", "sighting--26fe51f9-cf1f-4bb6-88bc-5703ba7b2a9e", "sighting--ff254bbc-c190-434f-b447-9a8ab8ce309d", "sighting--8dc04d4e-09cb-4147-8e15-a6d31bee4d40", "sighting--a637879f-5b13-4fb9-bed9-55872da91e77", "sighting--6c35903d-8448-4851-ba20-91dfa9bc5b47", "sighting--99aa66a5-6833-4395-a748-586fc996af92", "sighting--974001c2-8436-4dee-b3c8-afb2debf4446", "sighting--93a1ed74-8140-4f79-a25e-91e37f7d526f", "sighting--c357aff0-fe93-4172-9c89-b5f60e005789", "sighting--762223bf-b645-434f-b14b-d2cc618b98ac", "sighting--83d31fc2-9933-42d7-8f73-d133f1b5bb8f", "sighting--d39f861d-27ff-40ad-8a3d-e24cdb08f68e", "sighting--30fcf023-c728-41ea-9602-3d89bc6e97de", "sighting--95559117-5de3-4f4f-bf93-9249e352e686", "sighting--1f4e6511-f185-4620-ac10-b894e0bc79a7", "sighting--3bc0186b-1e8c-414b-881c-68f5106bc96f", "sighting--6af1383f-66d6-4bff-a383-0209dc1fef52", "sighting--af4bf1c8-1711-4fd9-b937-cb12454396ab", "sighting--53ba60da-a0b4-40d6-8611-0ddc7ef6bcac", "sighting--0fc2d09b-db3a-4de8-97ad-884436789366", "sighting--970e2f97-e2f1-45e2-af93-8990e476898e", "sighting--63f5e187-058b-4b59-bb7f-fe79668daaae", "sighting--0715c85a-5478-4f6a-ba36-3eff91c58540", "sighting--533fb4ab-9963-4b82-8686-8f767466f159", "sighting--9a062315-dcee-4282-afa1-05e884733dfe", "sighting--1182441f-e056-4d93-8fd2-cdbc590d7004", "sighting--970eb175-5ada-42f1-a980-3ad3734eb097", "sighting--a58916e9-c9e3-481c-a58f-3c3e7beaa41c", "sighting--6c199ad0-1c7c-4b72-98d3-b5f460c243e5", "sighting--fa3ae9ca-42a4-4666-9c7c-fe74b1b37edd", "sighting--50008b2b-93db-4fde-906f-0b4ee1f2c539", "sighting--1e19ff85-2b19-4d69-99df-1df120285f3d", "sighting--cab63aa0-3767-48e7-99a7-bf294bcf908b", "sighting--ea8e552b-e37f-45c6-ac29-74ce6d864686", "sighting--09860124-7cd3-48af-a8ea-ad438c0c055b", "sighting--182edc32-ac84-49d1-bdf7-22ca85c6b601", "sighting--6c9e58e2-43a8-41db-9da5-96c993b6fe50", "sighting--405cb87c-bcd3-4115-a87d-77c191472ad4", "sighting--1460195a-2459-4d9b-9250-e7fce77955c4", "sighting--44368016-609e-4fc9-9756-7dd4c7666249", "sighting--fd0a6113-c639-4d74-a426-526f11e5d507", "sighting--1e93d8c2-ad50-433f-a530-0a67832681c7", "sighting--a08c140e-c395-4769-8d15-f7c8ed60abb2", "sighting--39a00b0f-ffbe-40ad-8c37-f1de0e112bd6", "sighting--c217436c-cca1-43d2-aa3b-5108cb452c8d", "sighting--78b78dfd-4f51-4266-9f2f-0afb3a07ef3d", "sighting--decbf31f-9f39-4686-af17-1137b2a30928", "sighting--2e82aaf6-cae7-44a5-8f4a-ec7697366670", "sighting--953488ae-4b8f-47c8-b7b2-5a39a7fd5633", "sighting--0872d494-8083-4bca-8a4c-9163b39e74d0", "sighting--a6bb8a1d-ea9d-4982-a16e-99e853821592", "sighting--51568c35-4ebd-4381-ad93-400d9720bd0f", "sighting--94b2948c-55c9-4708-946d-b2d3dc03bc4a", "sighting--c22267f7-c4fa-42f5-8330-0f94642667b1", "sighting--6af83b37-d5a3-432f-9d77-b171d00dc66a", "sighting--2b0907bd-0443-413c-96e9-33440864c43d", "sighting--b07b6672-e979-4381-9e9d-5e9197d4d373", "sighting--6608dcac-4b9f-4459-bd28-17649d43b6cf", "sighting--6252c0cb-b437-4d8c-9786-09976751fc6c", "sighting--6334aad1-0343-437d-acde-a2d87c4c5522", "sighting--450fda13-36e6-4a06-afb0-d33bad7de46d", "sighting--79a5c6e7-85fd-4d7a-be06-3b2f69e4e711", "sighting--340fe4fb-bdad-4970-8c73-6afb1b6ee21e", "sighting--19bf0895-77a2-45d6-8498-0aabe573b46f", "sighting--505e5384-bd40-4c36-8b5b-fccc0cdab00f", "sighting--bcde6923-bd05-41c9-aa47-98ad6ddddbfb", "sighting--25fa5f51-8464-4428-8812-acee86900d81", "sighting--61e9e1b5-56f5-4fec-ac5d-d9af571cebd9", "sighting--9ae24ec4-e22a-4785-bd89-488d67b2d17a", "sighting--bfa622f6-6d4a-4ae8-a305-b14ab1650574", "sighting--c571dd3e-b1ac-48fc-8994-f3898186002c", "sighting--006a286a-6c47-4c9c-ba97-043162edfd8f", "sighting--3e7b7985-484e-4044-8a8a-253cf4962b59", "sighting--4fbfcd7b-6bbf-4fd6-8e09-6606c6258cf6", "sighting--0fddfc11-246c-4cb0-b1ef-27c9f00ad0e7", "sighting--1661fa21-0903-40f5-951f-b92856f6daa0", "sighting--12a2c8fd-4498-49e8-b2c5-576e22c7be98", "sighting--a3c1012a-498f-45c9-bc07-ee486c4b5e84", "sighting--432edab9-8c84-45b6-8fde-55d5d8e54081", "sighting--2848a7fc-e2df-49ff-9c5d-8d9b469a0116", "sighting--269c9d93-0040-4bdd-a3e8-5e8825e33174", "sighting--f875c25d-eb98-4b74-a8db-36e21f50f13c", "sighting--8aee7825-15b9-46ca-90c5-c277cc57e968", "sighting--665a9eb7-e621-4a49-abf0-d2b890944762", "sighting--19d7bd5c-e293-451c-858c-bc375f50e008", "sighting--5ae6a8f7-d8f7-4c83-b584-765d274f4576", "sighting--1c0a648e-fc74-46ab-8f15-f9e0d13963f3", "sighting--ed7afe79-6f41-4a10-9234-f5b654226199", "sighting--28cd88ab-64ad-4818-ad64-464d26588550", "sighting--1072fdaf-7162-46ef-9536-b70504dc9962", "sighting--ad3004fa-2f15-4f64-9977-11505943175a", "sighting--7bb00d13-2deb-4035-b972-b463343b5691", "sighting--ef420352-0fb8-4f0c-ba1e-0e451f394c6d", "sighting--e27c7f78-ac8d-4cc9-8597-b084ea98e7f2", "sighting--ceee1d4a-b866-4b29-acba-46b4100d56f1", "sighting--03218468-a657-446a-b961-46bd17a147c5", "sighting--f148dc35-98c3-4ff6-afad-d147a71e19ac", "sighting--bfa64cb1-b807-4a12-b5e2-803953d2b998", "sighting--13c4cdae-ccae-4de2-89aa-4ec8eca443dc", "sighting--5101d8b7-76e1-4ea1-ad62-6cad485736ea", "sighting--cd9d71d2-a7ab-4b74-9ff5-9e93deef2cf9", "sighting--c0cf73ed-c073-4bec-a504-d1a999a2432c", "sighting--e75e0c8e-a0ff-4df9-80d5-7a36a872abe6", "sighting--a0bcef07-f348-4ac0-a6f4-aefd5a0a8674", "sighting--7638d3a7-1cba-4dda-8888-746e8dc9776d", "sighting--f7b22961-6d47-49ae-a6fe-64c004eb3244", "sighting--dcca6652-9dd0-48f9-b1e2-2fe12e854d8c", "sighting--1bc4228c-ea3b-4cf8-9bb4-7bbff5d14b94", "sighting--3bc317f6-fe23-4e7f-be0e-66d593cd4b8c", "sighting--bd92966a-5975-4f96-b78d-7c62a626b5dd", "sighting--906670aa-34aa-4e88-9411-3d759b95d156", "sighting--59fd4684-be5f-4969-b3d2-86aa123404ff", "sighting--79941551-2fd0-440d-b048-c55aaf64f909", "sighting--84a14830-ad5a-49fd-91c4-292baab9f3bc", "sighting--0514b88a-5a12-4d22-9ac1-3459a41ba358", "sighting--8f0cc735-240f-4dc7-8b38-edadf22e419e", "sighting--9ef2eb0c-63db-4781-b9c9-bfe0cceb6cdb", "sighting--163e9477-47a3-4175-b901-2ea7d0774342", "sighting--c6f6d765-af0c-4021-8227-ef35aa6939b1", "sighting--a3c7b83a-64d8-4fed-93f1-a9bcfe4af2fd", "sighting--59f026d8-af99-4b1d-a158-6528ed8a7a2a", "sighting--24a22a2c-a4c1-433d-866c-b41d086e2446", "sighting--98ee83e3-c50a-4596-aab8-41352713b911", "sighting--ec816c96-4a63-4618-aa82-b34b7e3ec848", "sighting--8591c78d-7b00-4847-9fd8-86f8ecb2de62", "sighting--fab9b7cc-4e4d-47ee-87d3-b76a9789317b", "sighting--12167357-bb73-4b2f-861a-82b7052534c1", "sighting--b04bb695-e517-44c9-a3aa-6a7604bceed0", "sighting--4f921016-8915-4f4e-bde6-650150df1321", "sighting--c3031e13-09f2-4711-81df-e4a14ae96ef6", "sighting--e80da9ea-60d7-4564-93c6-da7df0c23c1b", "sighting--774e6dcb-cd26-4bde-a087-eb5b71b0b61d", "sighting--b405ff0a-5360-437e-82ec-faf363e1db42", "sighting--2b8f0ca7-86d1-4629-b625-0fd7addb9e7b", "sighting--db382bcf-2be6-439b-b3ec-041f68000e79", "sighting--ab05f399-16f4-4212-90b8-1ae27b56d10c", "sighting--2c033f11-1887-4d82-a9a2-91429186f77a", "sighting--a81b0c8a-d9a3-42e2-93f5-a5d2e879ddd7", "sighting--52373857-f115-4b58-a3c8-627616a8f87f", "sighting--7b115881-5e2c-44b6-9f91-c14c9757ddcb", "sighting--2371117a-18f1-4097-a19e-baa2566c7b3d", "sighting--1f7a20ab-eea4-4d7c-b69a-1445bc61d62c", "sighting--d5e8bac4-e14c-459d-bbad-58b231fda65a", "sighting--3caaf5e1-ee21-42ee-a609-4172a10038b0", "sighting--a171d8a7-83e0-40a7-94dd-397ecaf3ab10", "sighting--93892d21-2ddb-4feb-8932-878ff5ad97be", "sighting--017cac49-b827-46d8-b4bb-874b11494f2e", "sighting--bf2b193d-6ed1-4579-9001-9d6104023357", "sighting--8cfaba44-6401-4e49-b648-a364733966d5", "sighting--0dc5c55d-25b8-4ec0-b38d-a383dce728db", "sighting--c70ac4c2-248a-4a68-a608-3e2a722a6551", "sighting--1f9f9d51-ae7a-4dae-bf9a-5b93da2076a1", "sighting--499d5ce3-12cd-45ba-8e93-c7a7e356ff96", "sighting--55615729-f6c9-4f3b-8c6a-599868733615", "sighting--923defe8-1864-4f23-8fc1-ecd34e4b36bb", "sighting--6dcedab2-4bf8-4549-8193-8fea0e7220c4", "sighting--cfcd68d1-5ee4-4ef7-9b1a-7fffd377f6c4", "sighting--151b4a0b-42f5-4389-b268-1b39d5f68cc3", "sighting--f700ceb6-ba7d-42d3-80fa-15838533c2fd", "sighting--fada023d-e5ac-4169-91c3-33f2796ec1c7", "sighting--60692533-2af1-4ef3-824b-79f54bb0e3d6", "sighting--8c5f8a22-3f96-445f-b9ed-65d4d4fd9871", "sighting--0089542f-91fa-4f0d-bd7e-cd945d4329a2", "sighting--94d28cec-7919-4528-a7ca-54ef2346c35c", "sighting--d5f54ac0-4809-4c21-b8c4-ab80d42690ca", "sighting--6d23e7c4-44a9-4078-b8bc-203aac29a583", "sighting--880868c5-d6b9-40e8-92d1-0a2912622d86", "sighting--e8441ded-a129-4baf-ba8c-c86891418af1", "sighting--b64eb846-fbe8-464d-a82e-67f54a2f1ed7", "sighting--d85ae4e9-02f2-4845-a399-b2fc0fed605c", "sighting--6b3deaa3-f8b3-49e6-9fb9-7bb8fba2e7bd", "sighting--3b95aa1b-69b5-4cb1-aa5c-b01536a9fb7c", "sighting--fe918cda-b7e1-46f9-be61-002c0514cfa5", "sighting--63d84b55-6083-4001-b054-ff001929d45c", "sighting--61716cb2-551f-4bc4-9f83-5459dc8ad46d", "sighting--256d5a60-0c6f-4973-a496-da3b924ac2ad", "sighting--416066be-ae30-4aca-99c6-88f3a6df98e2", "sighting--e848fe04-ce03-4d9d-bd20-3f0e502374e1", "sighting--915e535b-0efe-4909-ae9c-31213b64e4b7", "sighting--8553075f-3947-49dc-bbb3-19774845c2ee", "sighting--ec80265f-3475-46bb-8c75-f1a0d0b72f27", "sighting--409a171a-19e8-4a68-aa4b-8df5e9a5a8fc", "sighting--3c6f3028-27fa-46bd-8cff-1b3b35d9c16b", "sighting--c51fcf49-5ae2-494f-b17c-02f70aac0dc4", "sighting--83aff9f9-cdc3-4f2f-b6ac-eff1879d2c8a", "sighting--d85d6efa-92ad-42a5-9ae5-2f7e8abfa28d", "sighting--7e973050-9db0-47c0-8e05-36ebd0a74721", "sighting--3f9eeef3-1a5e-4ff9-936f-cb63538697c6", "sighting--42b3a47b-8895-4b6c-ae9e-f3741b79cd60", "sighting--05b1a478-f0eb-4d2b-8bf8-d8c119966ce6", "sighting--7c750cf4-6543-4b2d-9638-13a9e122b895", "sighting--b50a3142-b04e-49a0-9454-35a3e024e8a3", "sighting--5f20de39-b3e9-42be-bfc8-245aef272a5a", "sighting--b389deb0-b6b1-4fa1-a1ed-25e6c4b3c84d", "sighting--83c38195-1145-45d9-82a8-ae9d23548cae", "sighting--7e65c08c-741f-4d52-880e-69a383ee70d7", "sighting--d0b79faf-524a-4f2e-adba-87d9e161cb33", "sighting--3b247b64-70ec-487e-8f25-96954547a444", "sighting--0558b070-e304-4ad7-9823-22be65960ce7", "sighting--643e148c-ba8c-4434-9bea-e7b7219b16ae", "sighting--8ee25b65-6864-4035-9241-be96a4661297", "sighting--50d98ad9-fc56-48ea-9959-e3c44da887e9", "sighting--58f110cd-aa09-4da2-bf9a-928dd2ed8bf3", "sighting--268c51cf-7ebf-41c5-ad1b-0f49242ef819", "sighting--880783ca-102b-4743-9047-9e1d0db645cb", "sighting--849df178-6726-402b-9cf7-42054b0bd14f", "sighting--901ef041-d3c8-4223-8a5d-a401eed919a1", "sighting--7204327a-5d6e-4e2b-8f21-5a90a3a6f904", "sighting--8d9c4abc-650b-4404-a83b-285da4d83c8a", "sighting--ce6ff149-583f-449b-b3ba-4cefe3769429", "sighting--9cdaa42a-cbbc-4fbb-b2cc-e3e9e49de9c1", "sighting--ff061cec-672f-4b46-af92-4977673d0e75", "sighting--61dd6223-d880-4924-a78d-4b9703d76112", "sighting--1fe8b0dc-35af-4a36-99f3-a42a183ef0f8", "sighting--fc07f4f2-ae07-4847-9f0d-0fb6dd3b496c", "sighting--06d6b728-12bb-4d8f-af2b-54583b0dee92", "sighting--9ecf2438-1478-4fcd-b0e9-0235cffa57d8", "sighting--08525f28-f866-40ce-8145-fe2264b7e391", "sighting--4715825e-17cc-4da6-a0ff-754bf69ac640", "sighting--a9e539d9-8c78-4292-a1c1-f0c1e5304b81", "sighting--8c82df93-1b5b-4fbf-a25d-6821da3aec7b", "sighting--032aecf8-73c6-4aa3-a957-924ed511456e", "sighting--d01aae60-cfde-4d8e-910a-084619f32670", "sighting--b5e85ddf-04b8-4ba8-b1f5-e0e0f52f5183", "sighting--83da99ec-04ed-4619-b2ed-e27728a2d2aa", "sighting--0ff7aff4-0e62-4312-b402-e23d4b7d1f16", "sighting--0d560fb6-09b0-4061-a4b8-5efff52508fa", "sighting--1b93569d-49bc-4c3b-94e8-440548a259ee", "sighting--797c160d-c5a2-46a5-a9fa-baff708001da", "sighting--bd7b1b59-6a85-45cf-ad6c-ab677eb27b5c", "sighting--d6677e1c-e841-4324-a586-e72c97a80849", "sighting--0ae5c48f-fa48-4db5-9468-6b063f0288f5", "sighting--7fc48634-2e36-4bb4-a733-979ab59b746f", "sighting--2e83cfaa-d402-4767-b7ef-1688c3671bed", "sighting--f7438363-dccd-460b-8ebe-beb73399809f", "sighting--46618cb8-7229-4d47-9d78-321f5f6971c9", "sighting--3baa7ee0-2027-4108-8772-667964529a56", "sighting--775dacd1-a2e8-4948-9213-bf558067ac91", "sighting--882105d1-4c23-4688-a27a-258be4fd5c7d", "sighting--27d9b629-c983-4043-ba56-17f706a1f563", "sighting--8661a11e-b736-4cfb-a7d8-4273dcc8c419", "sighting--6e257834-23e5-4379-b27d-d76e6e1b0dcf", "sighting--1fe6394c-8bf2-4312-b872-32867335fe8e", "sighting--88a2160e-d9b7-4326-b5d8-c8c3653c4b0c", "sighting--7485befe-81fe-4ad1-a2f2-b15334a29fd1", "sighting--5bfa4bd1-19f7-4a5f-85f3-dbd40f566bee", "sighting--edf36fa0-7596-47dc-bf5d-904967191ee8", "sighting--b0455714-7737-401a-a781-03b5fbb6fc62", "sighting--ccdf46bd-8a10-4c69-b962-e95a229a7df1", "sighting--e5c0eb9d-36c0-4434-8ed1-0a09a2b1b8a8", "sighting--c42469e9-8378-4fd1-8ebf-271025ee0136", "sighting--bd36c18f-84ef-4dfb-8b7a-d09537a14446", "sighting--52131e85-a585-477c-aaa0-3eb2bec76a94", "sighting--9d3b3096-5e43-4cbd-9211-61528d6d67e2", "sighting--1b70db66-14d0-43e6-9f68-3cc918994953", "sighting--b6276018-53ad-4164-ba9c-c35d582d2c03", "sighting--06137e54-a825-4498-b6ac-97681bda862c", "sighting--c3b0782f-332a-43f7-a0b2-8cca064bd8e9", "sighting--846e6be9-b355-45b9-9e63-65c1c7ff90fc", "sighting--97d1e4b1-0da0-4f92-92f4-b3c9a8ae3d06", "sighting--c40ca135-4817-4dbb-96d6-3a79a7bfeefd", "sighting--b225b372-89b6-426c-92e9-2ef84f889fd2", "sighting--5e34b6b4-0d39-4ff9-87ad-e2538e7bd97d", "sighting--76b13a4a-7457-48d8-9c29-e6eb2bbd5e96", "sighting--1dd80dc1-d8dc-4fb4-9adb-c6e919923d6c", "sighting--1c54d20d-49bb-4792-89bf-b64162670207", "sighting--f24ee517-65af-469e-9acb-5acd24393223", "sighting--0384481e-77cc-4149-83a6-24b59c6daf53", "sighting--7f41a502-9038-468d-98af-10e8a376e10d", "sighting--c7e28b18-27ce-4958-bc1a-d827c3b63e1e", "sighting--be2fdfff-bb7d-403c-a2e1-b5dafe925d59", "sighting--1ac649e3-21a8-4186-b660-c96d55548bef", "sighting--eb3dc9f1-935b-4287-a376-73f0b9169f9c", "sighting--572e3edc-e6c0-4e61-9064-43d9e42d1f51", "sighting--df1539f2-c1ab-4c51-b0b4-b00b7a7fc267", "sighting--8e168e75-5e47-4779-8c97-d877cccd2c7a", "sighting--2d78de1d-0d29-4df4-93df-d2fc519bde84", "sighting--67204928-4ce5-4a54-a259-0336b9f7ad9b", "sighting--ce7f6b72-3f82-493a-b90c-668b3b98f6ac", "sighting--fe2b58bf-2df5-410d-bb5c-607a00bd2729", "sighting--bd3c5613-08b4-4408-9006-c57c31b45c88", "sighting--d109116d-d359-4dc7-9d34-55f9ad363fee", "sighting--ea73acff-1718-4af5-8269-7b89885827f9", "sighting--e9da507e-cf7e-4517-9891-7209786e2057", "sighting--da782913-b8af-4f33-b1ff-cf40ca5a54b4", "sighting--d2f29336-2298-4aa4-9e2e-7748229a834b", "sighting--2c6314f8-a81a-4f93-8fef-3177a0a5c4b7", "sighting--913ea743-eabc-4447-b9d7-a0bd3c0bea61", "sighting--d0d021f9-a8b0-482c-bf5b-b1e59830af91", "sighting--43edd22e-04e7-47a3-ae03-94cf96f75df6", "sighting--e19cf7ba-c0ee-4171-82fd-4ff04ccefcb1", "sighting--86030c44-39ce-44b7-a89f-02e6a0ece5be", "sighting--a9d20788-e963-48b9-a239-a57583c29e89", "sighting--31bb247f-dd91-407f-9b70-869dded9f3b6", "sighting--ff07454f-23fc-4b00-b530-9f033dfe2313", "sighting--ccc0381a-998c-4590-9bf8-cf1a2fac1068", "sighting--bd0d5c21-8be5-442c-a110-14f644d93eeb", "sighting--5c6f7eb6-4d7a-43bd-97cb-b1a27bdab005", "sighting--fb971739-c09c-467b-800c-35e751636ae1", "sighting--7dc962c3-0874-4297-95ee-ee07b4ecf4b5", "sighting--5a0ca6bb-0ec5-4510-a253-e8603122fe23", "sighting--293308a9-60ed-4936-9b06-7667542b1d25", "sighting--f9afe31b-13a8-4da9-866d-46fd9edb0fca", "sighting--f2058d20-31af-4b5e-94ea-1e1ba1e2ef17", "sighting--3bcd757a-b9f1-4f52-bec3-1fba2f96d4b1", "sighting--4e612535-0db5-4c6f-9eda-8d1b1da16a09", "sighting--bc90f7a4-397b-46cf-93f4-a1bfec64561b", "sighting--38409068-ca45-4c88-b564-59dd2ecd6b5d", "sighting--91318517-f13f-4723-b4ab-8f4891721f94", "sighting--c2e90764-8144-4b9e-b61f-95f64f7aeb90", "sighting--f66d773a-c42c-4aed-ae5c-8b8b7c3db251", "sighting--d1853f9b-83e4-4a9a-b16a-954d2244ff16", "sighting--9dcf1c94-a8ae-4dec-8469-1ecb16331a47", "sighting--251c4a1d-e18e-4563-8860-0b4358d0a7d6", "sighting--939e1606-737f-421f-98b6-46e60507dbf3", "sighting--277c0b9c-5cd5-4ce8-ab4c-c406275952e4", "sighting--39c1d6d2-f695-4d20-ab73-864036e0e2d1", "sighting--55a8247c-9c66-4644-96bd-c24d5c37231d", "sighting--13a582e5-fd53-45ed-a8bb-79235b7ec137", "sighting--2aa51a30-4d42-4544-8235-462c395967db", "sighting--93696c86-6017-49e5-99ee-a2c10b78c498", "sighting--c5f87485-74bb-4984-bda0-6a3d7c168c9b", "sighting--6ae5cb7c-7964-41af-bb66-0bb3ddfd2476", "sighting--03c933ce-d7de-4b60-99c0-12f0f5df4c8c", "sighting--a70d9e29-d061-481d-9b43-06bd83b26ade", "sighting--7e9165d5-2283-44b2-a8ec-c3b45da240d8", "sighting--00fc9e5f-fac5-42d2-84ba-1d5d3d6d3428", "sighting--c15a7a87-0ded-490e-afd3-70f7b4c688de", "sighting--f01d6873-0b64-42d7-9dd1-3ab9980b4548", "sighting--4fa25846-d022-498e-a2f7-e9a865650d1e", "sighting--913697f5-4ab3-4363-84fb-f34a7b34499a", "sighting--2fa65068-53a4-4953-8a7d-90d3fc72ff3f", "sighting--d9ed98cf-cac6-42f2-a1dc-6e4be4ed0eef", "sighting--a93988c5-3dff-4270-87b8-5f41ee8127bf", "sighting--17489c6d-c1da-4912-9ab5-c7ba36658a78", "sighting--b8425fe9-922b-47d0-a6ee-9eb864603ba4", "sighting--5826c3dd-ad10-4416-a3d5-3c52e0d81eb1", "sighting--ca53561b-39a6-4d81-981f-2f66e723fb10", "sighting--51b9db1c-1ddf-4d87-a30f-0de976038f9e", "sighting--a4783c2d-a003-4a78-abd0-0b16fe2560ad", "sighting--ba528ab1-be2c-4e48-a089-86304da91812", "sighting--81842d60-f319-4ac9-9e12-3f465da0bfbc", "sighting--84b49397-c0c7-4438-90d0-512ea21a9c71", "sighting--ee260af9-374d-4b3f-9f88-ac15b159f0cf", "sighting--c499916a-1d5f-4dfc-a155-7b680b44f295", "sighting--4e91468b-d988-4203-b1d6-20fee29d0540", "sighting--eceaa003-bdd0-4741-ad80-22a6874fe48f", "sighting--0b2d3764-cd49-4376-8f9b-6201efe80bc6", "sighting--fa71653c-1fcc-489a-805c-b00814f326f4", "sighting--600f305d-97d8-4e77-a662-8d0227a95144", "sighting--e0c6303b-050c-45ef-a66a-65d8c24283e0", "sighting--c6cbddef-513d-4722-a9b7-410e58b1174d", "sighting--1dddca9a-0b86-4028-bc00-e72123c65a83", "sighting--d2ec275a-c209-4295-8089-38698cf79988", "sighting--704e5456-c607-41cf-b883-2f3a9f24f326", "sighting--0474464a-059c-4b59-99c1-b83580168814", "sighting--3b1cb747-1cbe-47af-9639-775ceae40ec8", "sighting--da0aafb2-88a2-4622-b1ae-dfe465c98785", "sighting--4130ce0a-df89-47a6-88e9-df16e4bcdb48", "sighting--6ce1ffbf-ac4a-42fa-842a-03fa9723c09c", "sighting--caf04869-d6ac-44c7-a691-3350f8b4ef8e", "sighting--3ded4fbf-7b21-4590-8788-8451a1d34d9a", "sighting--e4197a02-0a89-4ffb-ae6c-2e7ce3dc2044", "sighting--e493e646-48f6-4c04-ac04-f74e566b3c27", "sighting--f46fe685-3253-42a4-bd81-ac32e3450a4a", "sighting--0f3e57f5-777e-4750-be03-7409a7806e3c", "sighting--fc257428-8110-4dba-b7fe-62260ec8ccc5", "sighting--86f3434c-9ae1-482e-a504-3cdbc74c439e", "sighting--4b1db3b6-1ac1-4a6a-a6a2-8be843cc06ee", "sighting--1410569b-d587-4edb-bc6e-a02200acd711", "sighting--d2258eb2-af86-4357-8247-b186cd83b7f6", "sighting--41024ed3-3d74-4653-9353-d86418b2a603", "sighting--c27b0384-0a32-481d-9ade-574cc60d55a3", "sighting--f40be354-6e5c-48ba-9534-e873c3d53c98", "sighting--36a96985-af9e-45df-9e3e-99e97a448308", "sighting--6b2bf03e-006e-4ae3-8ba3-c9db144fe179", "sighting--51d377cb-95f5-4663-85d7-9c6433684dcf", "sighting--fcffd7b7-0765-4fd6-aeb8-fc8d25ce21dd", "sighting--e75ebc3f-91be-450c-bb0c-a990963ae7c2", "sighting--f3a668c6-dba8-45a6-b74c-2946426fdb39", "sighting--758c2d9c-e3cd-4fcf-83de-ceaf31670f1e", "sighting--0dd73c5d-1fb2-406a-a722-4bd32980096d", "sighting--fb71cea5-5453-4744-99dc-ce62e01a687e", "sighting--6b95f43a-57fc-488d-aa69-f2f56cba06f9", "sighting--ca377393-b877-4f03-a3d0-d5b6e87faff2", "sighting--c2e87241-93e5-425a-89d7-a8a8a2f07f59", "sighting--14ddaa44-0c88-4bc2-a2bb-53d805253f5f", "sighting--a49e7b79-81c1-43c4-b621-f7cd0ce356fc", "sighting--0a8f3308-1613-4e63-9c06-e24698062776", "sighting--187f7cc1-1585-4448-bd88-c765aae831f3", "sighting--892d7a42-d92b-4bfe-9564-bb8db5ea519e", "sighting--c70c6a0e-461f-477b-84ce-d43832cecbbd", "sighting--dd42fbbe-b97c-43c8-97a7-1092437965ec", "sighting--255a022d-1e71-457e-be43-4ddaed2eaae6", "sighting--39129ba3-9710-40b8-8d06-d853d9aa5264", "sighting--238a0ea4-4ca5-4551-b9f0-75c3031ebb56", "sighting--8e76c9b8-06cb-469d-9ba0-b5fd3aba4f6a", "sighting--689b9598-f3ab-4ca9-a7c1-22776fb74ae3", "sighting--bf191f33-301b-491b-9f76-de032b989f85", "sighting--fbd3c77e-060b-4116-a1bc-db06134444dd", "sighting--e9effdc8-07e0-4432-8e13-2755fbbe6c54", "sighting--c8c8c3c6-8769-4bdc-a5fd-e9de44af75d9", "sighting--c7adf966-7fb3-4694-9e17-e89dba86c8aa", "sighting--7ee09a14-1c2d-45a4-9267-fe1da911aa85", "sighting--dfae48ac-2fa6-4d76-b144-e2fc0d0c5eb0", "sighting--0f98804b-eb03-4b72-8af9-2c8729ee2104", "sighting--b54fd5bd-ffea-449c-a2bc-6f5e326fb647", "sighting--5aa00bfa-36a5-486d-b102-9dc078fa7d5f", "sighting--b27f8e55-5fe4-4ea2-8583-8e47e139b591", "sighting--5d58e933-e36a-4510-add6-ee830896e46c", "sighting--2a3e567f-e969-4265-ad7d-5b9c997f3638", "sighting--0575721c-7d72-4c8c-9326-e7ccb39cbcb1", "sighting--b62dea80-9601-4728-a21f-11c4fa901ce8", "sighting--eaf28ac5-768a-4cdf-ab65-99fcd557ed73", "sighting--61df6efe-1bf2-4e62-ab70-a73071c0e568", "sighting--ad851636-07e1-4859-ab6a-17c5dacb174d", "sighting--59b10314-1e45-40df-bfd8-69f2d2cb14af", "sighting--877a0ca8-a91a-4f1f-b2f1-9229ac9c2adf", "sighting--cead72dd-fdc4-4cb2-9f3f-d7e90d89fc6d", "sighting--5ebe6a1b-d799-43bd-bd72-ecccedf83cab", "sighting--5261a5bb-8001-4f3e-aa00-046908e07979", "sighting--751a2629-54d1-4827-9951-9fb7efd396b2", "sighting--0a6050d0-5bd3-49bc-83a7-10a7064b99b5", "sighting--c348dec6-f1ae-42a8-b863-6081816942b0", "sighting--40288eae-85b3-44c5-989d-37b3642df1ac", "sighting--59f28e72-5a4a-466d-9208-10ed3b620824", "sighting--8f813bbe-39d9-4209-b1f1-1f0ab4055b8f", "sighting--36a5d8fd-5055-4701-8292-faa76a905a7f", "sighting--70838ca9-ca0f-44e6-aadc-db7ee60f4ca9", "sighting--11e6d468-c053-44e2-ac38-c1997c363436", "sighting--d18269c1-9268-4f41-8a58-466270d71760", "sighting--37eed1eb-aa57-4e26-a479-1620a28485a2", "sighting--cfba3fba-b11c-4daa-9149-196fd2acf281", "sighting--f42badf4-6d5a-42f8-8c3f-5eca339bc4e5", "sighting--b8fd2c57-41be-43cc-8991-b1bca84b540d", "sighting--8b749bb2-584c-43b0-b33a-d402a9fcf6dd", "sighting--e53edf61-aa33-43db-b409-63d084446cce", "sighting--afd49190-d1c6-420e-9462-4bfaabc8e7cb", "sighting--8821ef74-130f-41e1-a205-86c3b46eedca", "sighting--d344b8c0-405c-49b3-a63e-db501dad62e1", "sighting--c43ae4be-8f0b-4ea0-9b3e-febc94a71938", "sighting--32e78ba8-0e83-498b-9e6a-4880bbb2d9d7", "sighting--37c9f620-f809-487b-9d1e-c8a83db1fa2a", "sighting--e1970825-9dd0-4476-8162-c46b8b7b73a0", "sighting--21b72e98-1d0a-44ee-b2d6-efa8b395cd62", "sighting--44c03ee9-6760-4b00-a563-f928e19fbc1b", "sighting--a2e404ef-6486-4480-b8c3-4c868d7852bb", "sighting--68222e75-e1a3-4187-a235-527c0ce77651", "sighting--52b14dd5-a362-4760-bf3f-bf5108a27555", "sighting--bb8f22e1-5ab8-4901-a571-86511a163d30", "sighting--9ac151ff-ce57-49b9-821e-234d7129484a", "sighting--90310bdb-227d-40b0-96fb-3158c6bcfa5b", "sighting--46778705-4b4b-4afb-a4cf-aa6b5d4ac3ee", "sighting--511e7d0f-242b-4885-8a86-b209eab52474", "sighting--4eac4dda-f658-4d89-925c-73a345a5fb9b", "sighting--2eb1d46c-c5c2-4dc6-a808-7a0753a2004d", "sighting--a28c0392-c8ce-4cfc-b835-8c3c9bbb2ba5", "sighting--cdc30a2e-7a98-4245-a465-e2362180d7ad", "sighting--ca2491c2-1a76-4614-8a8e-804ca180b911", "sighting--2c73c713-8105-4221-9409-8d2eb4992536", "sighting--158d855d-d4a2-4146-9c0a-68e5c563c69f", "sighting--aaf12d13-115e-4349-b045-061787e57391", "sighting--1c36c45f-53c2-44a1-9cbf-c924b9d7c21b", "sighting--05753c93-e9e1-494d-ba81-6f7a708f4c91", "sighting--1881c3da-e1b9-4706-ad22-870115435a13", "sighting--868caf3e-01a4-420c-8ebe-2f6676040103", "sighting--84dd7c2b-fe2c-4a39-bd08-1a946056f8ed", "sighting--7c479ed9-0262-4e6f-bb7f-35f75260418b", "sighting--a4e2c005-31dd-4548-bef4-ffede15fb355", "sighting--200d9e89-3432-4aa8-ad3c-c9c7938bdbef", "sighting--7329fbff-045e-4540-ad4b-2d4f5b91f8b3", "sighting--7ab6c6f2-43cb-484f-9d23-d294de122125", "sighting--e2f9c660-b2b9-41d2-907c-208fb35e4afb", "sighting--2951d06b-a452-4085-a5ad-fe93f53af69d", "sighting--281519d0-02ce-4adc-820c-3871edd2d5af", "sighting--1e8b6356-10ae-4b4d-9390-4289a4d8ed47", "sighting--f74d7788-892f-4b94-9e83-5e90a64d4a57", "sighting--e20cd6a2-d8e8-4830-b350-ee5c9125b56c", "sighting--085f98e3-e6b7-4275-9872-b1eeee1a6a44", "sighting--bd944a17-cfc0-47e7-b539-b1c100bc3a96", "sighting--08058dd2-e19e-4025-a3b4-6e0e7777b3e2", "sighting--05e79673-32e2-48d9-89ad-acc5a9281f7e", "sighting--d2fc4488-8cd7-4a07-bc27-b82961a3c005", "sighting--bf6c03e7-a49b-4e3e-bee8-f11e48c8b0db", "sighting--5b024ec4-0147-4f95-a0ed-ad6e70146bf6", "sighting--e2babf5c-7907-496e-a105-1b94cc79ff95", "sighting--402b84ad-c6a2-4d85-b564-64840d8f3ef5", "sighting--e68d45c4-d1b6-4b3c-bfe2-3695207baf57", "sighting--0a6b6053-12b0-4281-a02d-4eb5ee37bde9", "sighting--2ea7493d-29d5-423f-b18d-b4e926b3ee93", "sighting--92962268-5ffd-41f3-9b1c-8754abdb8c34", "sighting--4ecb9328-5251-48a1-8677-8f5ab95b8d73", "sighting--b0b7c143-77f2-482e-a7d9-c4f98c4260d9", "sighting--0d197e25-92f8-463b-a741-b29f0944c586", "sighting--2eb63eb2-5f98-421b-88c9-8f0d79d4c197", "sighting--d1590f3e-ce03-451c-acfe-275e98765e49", "sighting--9d94e3dc-b592-497d-a569-7c25fc64ec10", "sighting--6f21605d-f8a9-4419-8a85-464bf7225877", "sighting--4c71b7f6-6479-4a55-b947-5a1adfb77d26", "sighting--3b9be035-8ed2-45b5-bf03-457aced1f647", "sighting--414245b0-00f2-4edd-96b0-2e4eae0d5889", "sighting--f914c06f-0d44-4ce0-b7e9-d4f430d1b24c", "sighting--043e9e98-7306-419e-9412-d33779833598", "sighting--e7877d01-d7df-4bf2-9fa5-aa2406467d1e", "sighting--74eb6911-7891-4410-a71e-d702d1ddcb10", "sighting--807b4294-1179-491b-b391-3d1605454d8b", "sighting--90d4b325-17f4-4eb8-af55-f10059d9da18", "sighting--6ec2a816-9a63-4233-9b1d-ad6eb7549537", "sighting--69fc2744-d94f-4ac5-a386-136ecb3281a9", "sighting--5effd103-6fea-4054-9a82-561bf3593e80", "sighting--fcf5ed2e-f42e-4632-8c05-d3701bfe81b4", "sighting--014a4a23-4c07-469b-a54b-fa9cb1f0775b", "sighting--541573c9-405b-4d44-aa07-e596e212675e", "sighting--1ce447f6-c068-4ece-82c5-85980ad4edb0", "sighting--38b0eb22-11ca-4eca-9d22-ee0eb875350a", "sighting--d9386812-2c66-4ce6-a9bb-985d9a001c9a", "sighting--2689ce18-a452-40c9-9b85-956dc54965a1", "sighting--1677ce23-b5e4-4ed8-ad2c-266b1e103dbb", "sighting--782e6c32-2d27-49d1-ae27-b24d60189d0a", "sighting--f28314ff-1f2e-4dd4-867a-ae38cbd4d49d", "sighting--f72c35de-cb49-4c43-bc08-aa0daccc0457", "sighting--61482124-23a1-4657-ad59-7764dfff6336", "sighting--85d25c29-02e6-4e21-8555-99e7ddf517b0", "sighting--3e04f83c-ccf4-4ba6-9af2-b6f0fe775447", "sighting--44874088-02fc-4b8a-b907-c0968b2298e9", "sighting--31681f77-4711-4eab-bb04-358e5adb0d87", "sighting--fb269cbc-a31a-4898-b856-c8cf8068d18b", "sighting--80a267cb-d613-42d7-ae7a-5e2b7870304a", "sighting--b132359c-f2d6-4631-82d6-2443a1b078df", "sighting--4749fc4e-f61a-4f44-baec-80cd937851b0", "sighting--28971aa4-da48-4073-8081-e0ed309e2aa2", "sighting--aa0e8d8a-dc11-4b6c-8579-1fd8867cd999", "sighting--9321494f-ea72-4652-a17f-c7282d02006d", "sighting--af8463eb-4927-4496-aeb1-c97790ee8657", "sighting--d3a1d0d4-468a-4ae0-9e71-223719e98995", "sighting--c47ea7a4-363f-48c3-9979-a27802ce983a", "sighting--adf86008-bf20-4efd-bda5-3caa4db31dc6", "sighting--10cfa444-b4ac-4549-8e9e-6c0df2500fff", "sighting--66f93b17-eb31-458d-bd2c-83a37a4181ae", "sighting--5ae947a1-cacb-472f-adcb-0a71b6366bbb", "sighting--1dd1eeb6-105d-4428-b81f-cfec9b2cd0a6", "sighting--b22d1c82-4aca-4c80-94f0-8e7f3e1f17c4", "sighting--b2ef306e-36ee-40d0-9d5c-3dfe970f629e", "sighting--a3a55579-f373-49ff-96f1-8d80115096f8", "sighting--034ede82-1b78-40d0-81ca-2815a5df657c", "sighting--c7a69118-d2e4-49e5-8764-28e903e31603", "sighting--e5bb8e65-4784-438e-b362-7d1ad062a919", "sighting--d06b08e9-95d3-4b22-abe7-55551c45646f", "sighting--b6d48b80-ba74-47b7-9ec5-1492c16012c7", "sighting--da4b646a-332c-4391-a0aa-8e0d39e98c18", "sighting--16f35924-2ff8-4fd4-af4d-b1fb8d126ac7", "sighting--5ee863ca-6e8e-4590-a419-e994c606c0ac", "sighting--adb8e2c2-6ead-4a5f-8424-0356b4762d20", "sighting--6ed3b2c6-b0fa-4bf2-bb36-3e5d2703b276", "sighting--1fbe3e1e-0d0a-43a5-8512-b746960770cb", "sighting--90e77b6d-41c3-4cb0-ae22-88e1dc61c1a5", "sighting--bce0afbd-a917-41bd-afac-66d2b46802c2", "sighting--a9bb35f5-99fd-48bc-83be-1ac46bf542c1", "sighting--03f852d0-97ea-43d6-ba32-f579f90f463f", "sighting--4cb3c124-0a87-42dc-9e4d-ba09607daf7b", "sighting--c0e9b93e-9fc8-42fc-880a-54cb8c165780", "sighting--3ba3ce1d-5643-4884-bfc1-8a44461a024a", "sighting--80c788b8-8f79-48c3-add0-9276c1628314"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-18T11:00:01.342Z", "modified": "2026-09-18T11:00:01.342Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}