{"type": "bundle", "id": "bundle--8dde4bd2-25c1-40a6-bf0f-6e58cf940b7b", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--1e152ecb-cc3e-4309-88b8-7888999520df", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af", "name": "Reverse Proxy (Perth)", "latitude": -31.9505, "longitude": 115.8605, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--5d7a7619-15c8-46e9-baf1-59b28d7733ae", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--50114f6d-11fd-4d6c-b5e9-67bee023a6e9", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--13f515b3-0a27-4275-8c20-3062a3be7d9a", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a68687c9-42aa-4f7f-a22a-73d6a6f645b3", "relationship_type": "located-at", "source_ref": "infrastructure--13f515b3-0a27-4275-8c20-3062a3be7d9a", "target_ref": "location--1e152ecb-cc3e-4309-88b8-7888999520df", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--b8d2dbca-655c-4f48-bb72-e297ae285b26", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--49d4a0d1-d76b-414d-b98b-818357af7d9e", "name": "Reverse Proxy (Perth)", "infrastructure_types": ["firewall"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ad97e624-4271-431e-ab43-a60b1ea5396c", "relationship_type": "located-at", "source_ref": "infrastructure--49d4a0d1-d76b-414d-b98b-818357af7d9e", "target_ref": "location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--8cd11fe8-3f0f-44f8-95c3-f94cf4b17175", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b9720163-6c1f-45cb-a3ce-fb8d759153f3", "relationship_type": "located-at", "source_ref": "infrastructure--8cd11fe8-3f0f-44f8-95c3-f94cf4b17175", "target_ref": "location--5d7a7619-15c8-46e9-baf1-59b28d7733ae", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "name": "CVE-2002-1149", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--3dddb23e-3947-4513-9e5c-a23f65603252", "name": "CVE-2021-21985", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--6d5a1c1b-9169-473d-8fd6-3c26128c7ed2", "name": "CVE-2021-22005", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--55626788-d599-4661-af11-0bdff1a5cfff", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--35831716-8522-45a2-a30b-861c0c5b2cd6", "name": "CVE-2021-34473", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "name": "CVE-2022-22274", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "name": "CVE-2022-22947", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "name": "CVE-2023-0656", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--17385e21-038a-443e-8292-8e585611efaf", "name": "CVE-2023-1389", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "name": "Network Service Scanning", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046/", "external_id": "T1046"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1b9871cf-29bc-44c1-95cc-0588b915c1eb", "name": "Exploit Public-Facing Application", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190/", "external_id": "T1190"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "name": "Credentials in Files", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001/", "external_id": "T1552.001"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "name": "Cloud Instance Metadata API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/005/", "external_id": "T1552.005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf117a2-be91-4d65-b0f1-b5e4183bc521", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.15.52.154']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88d95bd-c8d2-4f80-bca8-e5c27638e297", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.102.50']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f8e2aab-eca0-4f56-9c8d-33ebc12a196f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.184.195']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--698166ea-07af-487b-9437-14debbf8aca6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.208.70']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b006395-e2ea-4be5-a66e-33e632d4e992", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.33.55.204']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7f988f0-46af-4d74-b202-180021a15df7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.24.66']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f47119e7-ec71-43ab-a867-786b38044570", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.25.155']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f9c5f50-8a0c-433b-95b6-12ec7fb34f45", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.25.248']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de091230-87d7-4418-bba4-1cb148c92bc4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.96.205.145']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eef3da9-8f69-42c0-b026-f4ea12c7cb3e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.96.225.252']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0e0d71-47ed-4288-99b6-5834ba964f89", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.96.230.94']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8cea7c7-221e-4618-8367-02b03f3579d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.104.107.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b409f0d0-d820-4885-8428-dded7cda1e59", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.130.193.150']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8acc059d-2a3d-46ce-9beb-06455c2aa772", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.130.255.195']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3328aeb-feba-4c08-9f72-231330ad18d7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.140.97.134']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9fce473-ae0f-4968-9e9e-5e238f842a57", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.223.92.101']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c51fcd1d-21e3-4468-823f-beab17e73c7c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.10.120.162']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9777f07d-4890-4497-a0f7-c24285bf3e86", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.10.120.172']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--031c5112-2556-4b46-9498-0a6fe721de42", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.106.77.178']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d387cdf6-3293-416a-8582-36db8b21c233", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.111.249.99']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0340928d-0c57-4b58-bc73-f71d0dbd55a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.112.55.113']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f4f800-1d28-456e-b0de-f3c102dc688c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.113.153.50']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92aa6a96-92a7-46c7-88bf-e8ed580f0eee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.118.82.254']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa3f22c3-7b92-4e8f-86f1-f985b2645094", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.121.20.18']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a65343be-c810-456a-a9a3-b4c8b65c5e2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.13.192.94']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce3e0aa2-7ed8-4c79-b76b-5247afc2c744", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.142.240.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e0945c4-e4d3-4180-a8c0-c304300d8175", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.150.124.150']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e0d70cd-68b2-4d20-ae3d-51d9e2c2e7c4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.154.179.151']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0707adaf-7ffb-4bdd-9a45-5bf99fe489d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.154.179.154']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddb52174-8f31-4e88-85e9-780720a35c57", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.154.81.166']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef04743a-5394-40e0-ac8a-b0e0a67dc1d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.159.54.240']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43f2a8da-8f3a-4e9e-ba36-ced956a63e83", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.162.1.80']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ab2f930-5335-4d56-a530-f6bd749c6157", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.170.157.62']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc06c59-2b10-4cae-aa86-ad8b6640887e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.179.173.70']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f9795d2-18ea-46c5-b022-cfa412c64280", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.179.240.177']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a050ed9-abd6-4e8e-9b9d-a650740c2708", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.21.148']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd6fa2b-086f-4b38-9382-cdbc94e9b8bd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.77.68']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa013f2-e258-4e08-a28f-0693601c49ef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.189.5.190']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75bbd90e-6906-4ffc-8c56-6f076773db52", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.189.89.145']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1195b225-5758-46cd-9125-d2d916a842b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.214.100.4']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62ddcc1b-a7ef-4528-b2a7-16434a127b98", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.239.252.132']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb8e0d5b-bc00-47d9-85f4-b1351b0a5d68", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.241.45.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad8bec40-aeb1-4c53-87c6-69003870dc8d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.26.81.193']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f091668e-d31d-49ec-814f-901901b8529e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.28.38.27']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2a0970a-d224-4823-ab40-8331d24f021d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.4.145.50']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fd60041-fa77-4c0c-9b9b-d7022a20a911", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.47.15.110']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98203c02-5de4-43d7-8638-e8d1215d06e4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.57.64.11']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--666d9871-f6cb-438f-9eb8-ef19eff6c1a2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.69.96.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3c2b7c-ff98-49b6-94e9-1d165db7f8ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.84.236.242']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41f56526-4f25-462b-b25d-c59785cbe836", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.91.246.101']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--857736ea-6421-4eaf-8d8a-cee5b00eb0b0", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '104.167.19.13']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8eadf8-002b-4967-8dad-4a8f0d51780f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.168.28.15']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f1de9ac-2a9a-4764-a087-d31bb5e339e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.168.53.219']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eebd673c-c9d3-45ae-a1b5-f6bf9d4329c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.234.19.77']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22327f65-ef13-4628-a26a-f5a14484ee22", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.201.80']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2356eabd-76d7-4504-bc39-4c1ce763988e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.106.113.164']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f32bb1-bbcf-4b9a-894c-b56648dda3f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.161.100.109']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3932dbc-2aeb-4a98-b074-250055612c9b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.24.167']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0dd7164-ceb6-474c-b9fa-e6a01a0e142c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.120.205.138']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c52136f5-3041-45d9-a4e7-9e29bb991520", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.52.171.40']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe7f9451-5da5-40bf-bb24-079a322a7178", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.54.62.156']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f61faa-574a-4b89-a2ab-524deb4c4c21", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.180.88.176']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c46029-ff85-4d2f-b8d1-091c138f0f60", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.27.179']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a686b21-7b65-4c67-99be-a8e58d3506e7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.28.96']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3042ac25-3afd-4817-b469-9eecde24583a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.17']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5adb9d3-abce-4cb6-9903-ad579a031420", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.66']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b7e7d1e-47f9-41bc-86c8-31af8430617f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.173.196.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2b16b4-f612-4bd6-8d14-0432c25c1278", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.172.98.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617bd813-e87d-4040-9e0d-0ab187301862", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.226.115.226']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5062d239-1b49-4e69-bc5f-10165187db9d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.38.8.1']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8281e4-1181-4709-a95d-c0fad0b41f8d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.207.210.163']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--845af519-3f1d-4b3a-8a7d-45bfcf7be68b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.38']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40ef53ef-10f4-41cb-92c2-5133340d9925", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.177.27.200']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59195254-eefa-407d-916c-f4408372f1b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.53.62.169']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b1e678-9dd5-4b7e-a218-7b066f560074", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.10.137.245']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de771ab1-5883-40a8-b6c4-01883a52b9b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.128.55']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f7b3d57-6343-4589-a573-12bfb33cf7e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.90']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--080be266-9573-4d1e-9853-7be803fe79af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.70']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00b8458e-1640-4c37-9c83-ee5f2d6e4b59", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--210a2ec7-86b8-491a-8c44-b9e4673c1d50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.135.136']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8297a6cf-83b7-4317-b335-611b96a546ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.135.229']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd66bbb4-df79-4d59-9823-ff5b53c48457", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.249']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7ad3989-f1fa-4ff9-aa37-3379c1ab8517", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8942d043-e59e-4643-b14e-d281c218ad8a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.7']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1db1ea3d-bc14-4f24-8ae4-e020719018b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.138.155']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e67d256-c84b-43e6-b9ad-0ca2c2449643", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.13']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3562b61a-cb39-4008-9c53-45ea54d77caa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb7abc8-7814-4b2e-b0ce-b39a68e683c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.50']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--689786bc-c6d5-41fe-98bc-fe42060c0cb3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.73']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59176fd2-0132-4836-9b5e-8f7a2d74b0c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfed579f-ed95-44df-ab85-916d0e7b5afa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.79']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f28c781-a8c4-462c-bbe6-911d51394dca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b4d420-d4ca-46f7-b794-d5515cde580b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.148.197']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc899e95-48c8-4e49-b566-732ff796be5f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.148.27']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f70a6945-8859-4cdb-b646-e1591623541b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07e83648-7cc4-47db-9ce3-bfbc5c853821", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17ce0981-08db-404a-8759-e0c046c20f15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a316ad6-ed0f-4f09-aac9-e2320121399d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a6416f-6122-4147-8086-e0c3a83ca29b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.77']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4171c310-ba4e-4d4e-8d7e-efdf20526bb2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.132']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d083f7ab-ddb5-444a-b6b7-57fef18efb6d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.137']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5be5cc6-3933-4200-8156-7555e98d1f37", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cba45feb-5e8d-4ad5-a31d-185d43cca08a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.154.181']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5baa83-e0e5-4b47-a3c6-982b43b47528", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d35d2ce1-db0d-490a-b31b-14c13af57b83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.42']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df40403b-1558-46bf-bde5-fafc4da68358", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cffc5069-105a-4cb5-af82-95a6a7952343", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.157.190']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--626b70cc-e531-48b5-852e-f26bb5b5e22d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.158.112']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a545c9cc-489d-40b2-b239-2f6dc9c45518", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a626a6-e4b4-4668-9bc9-5b1b82b5e166", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.146.121.179']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7929ab-92df-4d46-a9ff-050f4e55fbea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.146.121.88']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e95f7a0f-a7a8-4fdd-bdd2-e7b0bff7b3ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.138.163']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef0fe9c2-ba22-438b-9d0d-3e5b1142160e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.216.185']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76fb197-2710-4713-b8bb-93b8f7c80aa6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.68.17.246']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a714cd81-d593-4aa3-a8e3-9ac5583e50dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.75.150.3']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87cfc69f-623d-44ef-8cff-1e1ec6593b6c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.106']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08d324d9-b00b-4613-9c9d-4d9cc1c87c21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.241']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce7e514a-5cdd-435d-afef-00a2e3053c3d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.37.179']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21dfc13a-3176-4c18-8a35-e436d917315f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.66.204.203']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c4c1092-916b-41f6-b6b4-fed3f3dbb8c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.55.224.17']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57863da2-ee9a-48ff-9072-7ffadc515d25", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.114.113']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05f6be56-d855-481b-943b-13172868f0dd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.228.55']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85c2e5e0-7908-4b15-82dc-736d25aecf7d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.36.161']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7586f427-78cd-4234-a220-8e9553e1c830", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.96.92.247']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc29bd98-01fd-4554-8e87-9bad06d5d3a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.249.100.181']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90487730-0d6e-457f-b763-5eb5c7c50ea4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.249.100.43']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0da489ec-9a0f-4343-8552-2425568f2f5f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.112.103']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3fa6d4-c1c4-4efa-b574-50acf09b2c0d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.41.86']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dd84300-bac9-4235-b48e-3df14a2b752d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.91.20.139']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3149f54c-4c6e-41b1-828a-05039a0dccc1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.64.102']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa408a2c-36f7-42bb-ad32-d3342318e09b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.129.206.185']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5765d7ad-abd9-47ea-9cf9-5c7b1dc8c211", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.166.49.42']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0320727e-b7c5-455f-b14c-73f384496aee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.168.197.138']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12d730c2-3143-4b89-a24f-8d2afcaf8d4c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.53.126.30']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5055b64-d3ad-4112-aa8b-9e4b9e252a0d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.131.2.28']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b13b80c-81a5-4023-b56d-f994b5609989", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.164.17.192']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--768e3a95-05cb-4b13-8945-b2f5c7b7e26c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.31.2.160']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28457579-b712-42d7-9ca6-13f9b892cb0c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '126.69.103.63']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71f27194-99b0-416f-bb75-9dd50042be52", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.232.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e166e2b3-5ba1-4a75-a825-8d8e67be2dea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.159.56.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd4dee0-53dc-43e5-8740-705060e66ce1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.145.90']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c27cb55f-6f25-4f16-8bce-bec5a55e4958", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.148.148.91']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e932b933-b9b2-4aa4-812b-8642979e3854", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '134.33.66.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d4db5634-c008-4bf2-bf06-b94285c9e396", "relationship_type": "indicates", "source_ref": "indicator--e932b933-b9b2-4aa4-812b-8642979e3854", "target_ref": "attack-pattern--1b9871cf-29bc-44c1-95cc-0588b915c1eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f623923b-18e5-4b22-afdb-b6e524104d70", "relationship_type": "indicates", "source_ref": "indicator--e932b933-b9b2-4aa4-812b-8642979e3854", "target_ref": "vulnerability--55626788-d599-4661-af11-0bdff1a5cfff", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4360322a-a906-4542-bddb-6f85c97bade0", "relationship_type": "indicates", "source_ref": "indicator--e932b933-b9b2-4aa4-812b-8642979e3854", "target_ref": "vulnerability--35831716-8522-45a2-a30b-861c0c5b2cd6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dee130d3-48f1-450a-a477-aafcbe50be2d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.144.35.24']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a913b7c4-0c34-4c14-a86b-7790d0e15f56", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.65.45.244']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e445dab-f547-46d7-b3f6-4f6a93702ddd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.59.229.84']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088a03aa-a9b3-443c-8920-a95615be6506", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.124.92.243']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4239260a-bb41-46c3-bbfc-b2c160e726e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.219.242.24']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f8ae848-ddaa-4681-bebc-420b5e95e698", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.105.40']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fd34725-6b85-4522-9465-c153156eb39a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.41.249']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b9abe7a-3690-41fe-ad38-5d1553c9edb4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.87.77']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--037042dc-d32b-4417-ae11-20c5ce963faf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.225.239.154']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6c0c839-f757-4072-bbbf-4e31babc63a6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.63.221.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85338d16-c011-4dbc-ad51-7829350fb35e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.95.242.9']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e3d5919-07c7-40ae-a3aa-6fa72d411bd0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.27.218']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc700b0-bfe5-448e-8f0d-c67d79e6fc01", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.234.95']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac0d3da-a697-4caa-bb06-b54945bcd2f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.148.85']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9204abe-214a-4adc-8be2-05003d0b1449", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.202.209.172']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--435cbf36-5930-48bf-bfcd-2215d3f384dd", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.57.86']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb971eb5-a8f9-4b1c-96fa-4e5b13698828", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.199.17.126']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ba180d2-b971-4789-aeb9-37a7f665e06d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.56.197.150']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0cc8f4f-b190-4812-ab70-3d77b586dfe9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.94']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c95fb2c-5c79-41e9-b0b5-aeea63a600c7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.101.137.136']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5489751-4458-4612-adb2-2116d49e439f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.224.25.59']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67054db1-588c-4c90-bb90-7c32e4404fb0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.104.107.190']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e7badb-0207-48d7-83a8-00791e1463cd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.50.139.119']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f530e278-016c-41c5-a36b-70f61860a478", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.68.254']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b2b08f-3f8d-4aa2-a9de-7f01400f1d1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.40.242.182']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ca799c-04c2-419c-8869-cb29e3632ba8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.130.209']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca939e4-89ad-4f2f-b2b9-7fa54b8da350", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.40']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a558943-aec0-4270-8d41-3da8097260bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.133.199']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe33437-e5f1-4c34-8a98-7348960f5d17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.133.217']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e22d683-f940-4fea-9e3d-d7238ccc1165", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.134.135']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda5d525-a9a4-4c1b-b875-df8a64886b48", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.134.61']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e9cd7e9-1b9f-4d8a-afdd-9fb43f20c74a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.74.24.130']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaa90969-e849-4062-b4f8-d3a2062d7b3b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.26']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0a9582-647b-4f0b-873b-5816ff14ab90", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.182.41']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7121743c-ae52-402b-a254-de1357b1976d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.66.202']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--991c9561-64d0-4dd0-9d22-06ea682eba12", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.198.162.234']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bfadf2e-7a70-4396-ad48-568a51934632", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.134.18']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51194a47-870f-4cc4-98f1-6129c59e5f5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.55.39.225']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b648e72-c5a2-41b1-a626-e3ae41409a37", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '158.23.162.109']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--160fe854-ef4d-4e4b-bb57-7ba3ae210db0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.201.221']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a19ef107-725b-442f-8d2e-339476f693cc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.16.111.191']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6619a21d-be2f-4889-a635-3961a89eab61", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.22.107.10']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8d3a40f-1be0-4d9e-ba2f-919cd9bbc315", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.250.132.238']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18f815d6-24d1-440f-942a-6b5f93401a90", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.251.202.50']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d6f5185-14cf-4549-b149-5a6519988667", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.0.80.21']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe0a11ca-f414-4db1-bd31-e64b4b1eceb2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.90.185']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--638e18c0-ee1c-4648-a722-08b673ae20da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.81.113.97']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--248e2b31-428f-4804-9dfd-4d565b4f7a14", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.47.33.38']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0bf6a60-52a5-4a63-aa5d-a7ab134d7645", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.61.134.228']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46fc28fb-c75c-4c43-8ea4-42de96e4bd57", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.12.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b07ec2b-7462-48fa-9e5a-0689d402f204", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.13.143']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2255feaf-04d3-4718-a182-e55c1af5836a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.16.18']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38f3562d-baed-4a22-9358-0174c5ce0359", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.16.193']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38548828-c55d-422e-bf5f-0c6ed93bfacc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.3.241']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--359eb519-72cd-4f8f-a1e5-547a2cedf3f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.4.109']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--befbece9-1fa8-422c-8122-9dd701ebd9e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.160.1.220']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6abceb3f-7cac-4660-8e89-7308b7322f9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.68.113.236']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e014b49-a66d-408b-8c18-e76fd47884e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.187.190']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faecbe12-ffdd-425c-9885-eaab57f4370c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.156.67']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c506cca1-e376-4f49-8833-e6b7ad8e17ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.4.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c95c8e9-5a98-45c0-bf58-e1d14fe3ce7f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.150.166']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c08a7bdf-97c9-429e-b17c-7705b6aec8e7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.180.165']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--937acbc9-d0b8-41ff-adde-75f70bdcc1ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.54.128']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63e780fd-67a9-49a2-8246-6edaf7a77df2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.0.192.235']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83b947b7-297f-4f99-bc73-d28d4b494283", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.138.9']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58115340-7153-4a00-a0ea-75ae9e005a90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.62']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5fd3c05-a50d-45c1-b49c-cac5eb820c8a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.224.29.169']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ced7de4-40b3-456b-ba07-f29169292147", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.166.155.131']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31590592-4655-4bb6-819b-df5a5431e299", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.110.146']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bcdc611-a5e7-446c-8555-64a522123389", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.167.214']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36bfc9e7-3ad2-4aef-a2f3-732df8441d37", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.81.242']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2498919b-ab4e-45c4-97a8-38e62fd8a867", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.201.102']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3de3a7-ef06-4398-8593-0786d46cc819", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.50']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d60857-1a45-4b2f-bc5a-9a56b52ec5e0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.160.227.37']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aa4a7f5-8e22-452d-9e3f-dab532a4513d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.74.21.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a082e88-93e4-4ed8-8b79-3312e3864f4a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.150.176.248']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbaee239-96cc-4bac-a4a5-d7cb08cdf862", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.196.78.7']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f93c98f3-5669-44d5-939b-7a2f288f5a78", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.236.127.114']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba4c1e9c-1ec3-4b54-be0f-49182d4514a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.29.231.179']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be2ee3a0-21cb-4962-a94a-6b28a358fde4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.10.185.45']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6675bef3-b76f-41c8-8f52-52d3ebb6d2a9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.126.90.235']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f73d0e9b-21a1-43b1-ba0e-271be2af2e39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.69.6.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cc29e7d-b7d5-4561-9d1a-c85284a5b4d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.53.77']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8385e48-6136-410c-b46e-74fd915be934", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.238.235.141']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--405a3fdb-da19-49c8-96b8-b72f19b7bc2f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.27.90.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4134b78c-8cfc-4902-a65e-d12fea723da2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.51.174.242']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5d3d356-6f56-4a71-970c-d79cfb63d012", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.179.77']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5ac7442-636d-457f-8829-9bc2d8931738", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.93.144.27']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e30dceb-0ec7-4bce-9917-15a06c1b4afc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.209.89.254']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--363d9e33-e558-4b06-a198-867e31ebb2b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.94.247.187']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--424aced8-fff3-42ea-a784-296f7475bbcb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.171.213']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c900cb-0bb7-44a0-a755-b5e555e5a9b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.221.13']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--364a3ef7-8658-46e2-9049-b23b71222b79", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.221.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f8b958-8219-47ec-a9ed-a5c57fa6d77d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.237.100']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19ac8795-b6b8-45c3-a4cb-3c76b18b7bd6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.48.68.82']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--108ca67c-8223-487d-8410-1b35932fb781", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.70.123.42']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40608dcf-79d8-40a0-a8b8-b2908e17adca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.3.170']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b616778-2726-468f-a2cf-247c5501453d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.194.23.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e263d4-6fc8-40bd-8ebd-be8a6ccef5f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.141.180.88']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf5b9f91-d952-4b60-aa5d-b391594e055a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.153.231.36']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef746fb-753b-43a5-b615-0c3789a9e28e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.109.243']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193ebe8a-f75a-4589-a9fa-bd63238935dc", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.19.40.146']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb2539f-1227-45a1-b849-4e5bb4191fac", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.19.40.62']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9711f71b-c480-49f9-a21d-d303591ec41d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e59be5c0-736a-498b-862e-b7350a601df5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8484ea66-3a91-4a1f-92f8-83e1698f157b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c105c2ee-63bd-4949-aec9-fd486a6984a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84fde415-3b31-4e4c-9fe1-c1808447c3f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--734be533-8b08-4fbc-81ec-d64490afd6ce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8a86f7-951f-4bd2-8d3e-b4cb35dffd50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7349321f-5076-437e-8299-e7304a165e5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce2f7dc-2253-4748-b451-461171c74bbc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63aefb0-b9af-4b86-aeb8-2e7904b2d048", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb3aff59-bd80-405b-ac85-d9cca1935bc2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a61186e-6dbd-4959-98b2-393505aacbf1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8699f46-5d00-4e38-9e37-005843504999", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668ce408-3f31-4b51-9f33-90a350c3ab95", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--701cc2d8-46e9-4492-8195-c0777c481637", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8239b483-0b5e-43f6-a4d3-51127760834f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--004eddbb-cadb-4540-9c24-37f307bfc00a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e4d686-a8fa-4a55-9479-b90c997c2ec8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--561fbb22-6822-4458-998f-aff48b30f09b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d84fe07-9452-414f-bce1-f9eb621ec7ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.213.235']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cd81d15-d53b-492e-8263-908796597b8e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.240.215.110']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a47d7b83-09aa-4b44-8354-360df039f893", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.95.156.182']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a23c24d9-c7bb-41b6-b7b1-0447f8200408", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.1.56.119']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc17b749-b476-42ff-9227-da70bba62cf6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.104.178.91']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bf94a4-e0a1-49d8-82e2-bf59fa5e67b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.122.177.140']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a55432f-fd41-4f1e-b70f-56d690088c70", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.128.48.212']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3c766ce-6598-4b48-93ae-44c93863eca2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.131.220.187']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca451171-9405-420b-994f-8270f494b6a3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.148.224.183']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39c9cf3e-824b-4adb-bc30-f5523637109e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.16.206.82']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7453a716-7849-4ee1-9e50-56aa9d3de450", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.251.71.202']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621bee9e-0ce2-4cb3-bbc0-eecfb4320d4a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.42.173.68']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e5d4134-8b32-49df-8683-ac4a64c44b6f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.124.244.149']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc61a80-cd52-4a2d-8cf5-a3734677344c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.159.7']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7144dd3a-9edd-4994-b324-58ad7f940f40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.78.42']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4585a5a6-e124-4bea-a10a-e61ee39da716", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.95.31']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb3abfee-4871-4216-8dee-69cd31a39b1d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.217.130.86']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f794664a-27bb-43f5-b8d2-e351b994e3d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.244.108.143']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed8f485-ff88-4f2e-8cbe-cafc4bcbcbb5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.104.146.5']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b87f7381-c171-4dd7-928e-7ef11c0646a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.121.143.165']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad3755fb-1476-4916-a7e6-5038e2253cca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.129.122.12']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06f3ab76-9eae-4da6-ad7e-33fb6ba44b40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.146.138.22']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2bfe14e-7dbd-4081-b1df-653a0e18cd3a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.171.165.205']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0daede3e-973b-404e-8825-401f87753a15", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.238.105.148']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0add56f-63dd-4176-992e-922a3e25a641", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.82.113.115']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dabb45ea-4bd8-4da4-86df-15cc63cf480d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.35.185']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bbc3e98-cd23-4aeb-98fb-a1bd70e12bc4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.9.124.218']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c29985d-f5c7-4f5c-bf08-657ed60a37e9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.218']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6625cbf-01cd-49ec-9710-a5c1498da10c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.25.217.86']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79067779-a6d5-4899-a8a5-1cd618b11c9f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.31.101.16']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a8934d-1107-4982-90d6-532a5d376974", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.154']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c2db9e5-7978-42fe-a84b-b16f325b6084", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a250ca-9b02-4337-994b-fc88cc3ea0c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.47.62.69']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e520fb4-3b74-4603-a5a0-057a410b5515", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.90.12.230']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ea11955-5351-4455-a15d-79c4dfab6802", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.153.198.230']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3bd8b8-7062-46c1-b61d-0820b69111c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.191.192.165']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de877be8-4875-44ff-81e2-db5ca87a0769", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.25.171.99']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--379ed1c3-7238-45e2-9620-395cfb4bed94", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.142.175.196']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--248bdddb-4f10-4eb4-836d-a1fb48012add", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.104']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1151ae9c-d991-4d45-9f50-7fb5eecc5157", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.227']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0fc1a27-eca9-4f02-a565-da6f33eb58e2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.228']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2edd4668-8d89-4952-8215-05a49e03153c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.232']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7d5e1d4-acb0-48dd-8ff6-cada346cc81b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.72']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3119782d-7dd7-4bfe-b0cd-1c095eb46d89", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.182.195.147']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5206e61-783e-4cf8-85e7-134b7175c90a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.200.28.67']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63856ff8-6891-4409-9719-7ff21de12990", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.252.196.198']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f48158e-32fd-460e-b353-5534d748f421", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.10.129.17']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d8db146-135d-42a9-b3c9-7837f465e497", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.147.110.57']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b144f71-b958-497b-b9b9-4f0fdcec9592", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.253.54.22']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dbd50d6-c060-4598-bcce-4081983d9dc5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.27.82.148']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbdab16d-7191-4bd3-9705-c328c4581f3e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.10']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6122088f-cd6b-43f9-9ce6-4c814a935fcf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.11']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6314e30-a5e5-4f21-9e4c-63c38e1a5099", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.125']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea3e976-2d2b-46e9-8db5-a52c75a830b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.153']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84441d84-035b-4cf2-9db7-045e469e200d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.164']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a70876-c204-4bff-acf0-86f84444b7be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.207']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f86c85-3515-4214-9450-116310425f0d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.241']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca497608-92e9-4a8a-9309-0b4195482d77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.28']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--376c81ba-7e04-47ca-be45-28c1db5c030c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.30']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f917cae-8003-4f3d-8320-0326919006f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.64']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67861db-77d6-4394-9329-ff3902f1e523", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.245.62.60']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--498bb480-bb22-401b-8aa3-0ba5402436d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.244.88.221']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d92a29d4-9216-4c7c-9f41-cc5492f0ae11", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--361424de-b01a-4709-8c60-422bc6ec80d3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5346fbbb-8244-4e6e-95fa-f6bc49372bc8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.150']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2e1a20d-4b10-4f24-a59c-ca1b58034f54", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.209']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7a1c976-ca3a-40cc-8d84-feab7f3bafdc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da75402d-6059-403f-b82c-831110076486", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.153.204.5']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60280e95-b1f1-4a5f-b0d2-c5cdad8ae99b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.205.136.12']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a13f601-08bb-4eb5-a1f4-854643006656", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.244.28.141']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e30265b-d0e1-4774-b571-e871fdd63efb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.119.85.58']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1619b851-dd71-4da1-9984-ba685df4c852", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.150.115.228']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3c94072-7307-45c5-be6a-e91e327fc7ba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.155.76.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ef0b579-9b07-4ca6-9d8e-728385a200b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.196.50.91']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8bc6ec3-8af2-4866-8900-168a95d23959", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.27.142.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc22f26-66e4-4181-9801-309f3713595e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.61.51.82']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d58b29bc-6965-41f7-8505-797f0300dc0c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.16.238.49']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d313e38-dbc4-4455-ade2-a6fe0b89dc27", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.63.223.138']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--468ff3b2-e62b-4bca-9e54-cd7b1625726a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.158.19.179']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dc6840b-ae19-4a6c-97ee-b6d06a0b471c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.164.42.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f52e900b-6680-41d2-9768-7b430da5b7c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.170.91.69']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e031290f-3c3b-448e-838d-4379a1d50055", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.50.203.150']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e41865c-a5de-43a6-a2a5-f6a4b4e3e800", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.135.42.52']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67b040e2-914b-4dce-bc02-aa9e971a06f2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.145.143.163']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9befccbf-7a37-40e9-be16-956f878a28cb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.185.56.59']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd83bc35-2887-45b0-8836-3706ab799100", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.76.96.215']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79451dd5-4262-494a-ad83-5ec52faf2f7a", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.31']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bfaf5e67-a07b-44b2-8e78-fbd044fe0deb", "relationship_type": "indicates", "source_ref": "indicator--79451dd5-4262-494a-ad83-5ec52faf2f7a", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47900d45-9117-40de-8080-115cb510cca0", "relationship_type": "indicates", "source_ref": "indicator--79451dd5-4262-494a-ad83-5ec52faf2f7a", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40b1072b-3d31-4235-a716-a3f579ccc5f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.185.118.183']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1fb177c-595f-4057-b2f6-382d85784f84", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.129']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a4c0d3b-b94a-44b0-81de-cab5ffb0df42", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.131']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bfc7a84-65cf-4010-aafb-7c66b172a8dd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.132']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06f00a74-0a38-46e1-98ee-bca46e26e0e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.138']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ab8a7f4-dd66-418c-bcf2-6f1041b9d8ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9943578-2785-4968-b93f-0eae7a28d205", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.153']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8b20f5d-1b80-4562-90d4-f8a35f01fdab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.178']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--383da508-036f-4413-8e70-358e1528dcbd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.18']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eb63c89-4817-4f1e-95b2-0d4ea40c99aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.180']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43645cd2-26c4-4480-a521-d4e7a70cbf80", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.20']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2325bbbc-2559-4717-a5ce-48f465689e11", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.215']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc441bdb-4a9d-4ab8-9254-970c5e29c774", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.231']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e26f48f-6b0b-4e29-9e42-ff0119f02c3f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.38']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d212030d-19d1-43d8-9a39-f271e4b70ecf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.69']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52f7c1ad-155f-4742-be10-923c5ff47e43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.81']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3b44b54-8851-4217-8944-abee20464258", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.47.217']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd369a26-513d-4674-8452-a6bb228078b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.59.75']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a15ef9-45cd-40fd-992f-1278698433de", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.174.104.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7d526a-1992-4b14-b7a3-a405b8f6f5ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.87.97.90']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--412f1ddd-90cb-4c1b-8ce0-eb5b7fe070e3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.193.120.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--180d0d92-1070-4d6a-bb38-b80e62244904", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.20.14.156']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0594b9e9-3f66-47ed-ae82-09424536aa4c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.112.98.73']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d071bc92-2875-4c7f-8da1-4f0ee948855a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.39.27.171']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b68fa61-5851-492e-aebd-d38f81b19373", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.68.56.3']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da3b9aae-6e59-41fb-b825-b29517aab2e1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.83.174.175']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d35f49db-74c7-4826-b6cb-1749d2f2f3c7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.176.26.74']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8df438be-0947-4c2d-8375-085d4876a180", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.84']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a456ca0e-687a-48b7-a42f-639be0f596a9", "relationship_type": "indicates", "source_ref": "indicator--8df438be-0947-4c2d-8375-085d4876a180", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31d02f2e-b29b-4597-bb83-3e648437d75e", "relationship_type": "indicates", "source_ref": "indicator--8df438be-0947-4c2d-8375-085d4876a180", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--703fbb5d-6efd-466f-b988-6096e8634038", "relationship_type": "indicates", "source_ref": "indicator--8df438be-0947-4c2d-8375-085d4876a180", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088fcff9-5076-4111-b829-388e808fc1a2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.230.127.104']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51de0aec-0de3-4731-a6a3-e765d96c7852", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.42.31.237']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032edd92-a99d-45de-b989-1bb6891fae0b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.109']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c383f4-c292-43e8-a910-baa955b3da21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.117']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde97338-041f-4a10-ba56-d435d73217c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.187']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--138ef7a5-e2d2-46b7-94cc-c5fee8005f83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.219']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7daf85d0-d6d8-40ad-b252-e0df6db307d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.20']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f22aca-f146-4033-84e9-ebc50824372d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.87.32.137']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf77a4e-6879-4c9f-89e2-1467ded11087", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.77.171.138']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06886a0-4df8-421c-9f78-858cf7ec91e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.133.95.63']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c55b373f-e867-4d75-b684-75dd812999f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.104']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abcb4e5c-c7a2-4105-b372-2e587a49a377", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.174']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20faefbe-bfa2-402a-8a0e-4f61f5259214", "name": "Malicious Host", "description": "Web exploits: openwrt-luci-rce. CVEs: CVE-2023-1389. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '221.159.119.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--85a1a9a6-4e06-46ce-be2d-5fd7bd44e1f2", "relationship_type": "indicates", "source_ref": "indicator--20faefbe-bfa2-402a-8a0e-4f61f5259214", "target_ref": "attack-pattern--1b9871cf-29bc-44c1-95cc-0588b915c1eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36dedce3-4da0-4698-862e-8253f15b3d34", "relationship_type": "indicates", "source_ref": "indicator--20faefbe-bfa2-402a-8a0e-4f61f5259214", "target_ref": "vulnerability--17385e21-038a-443e-8292-8e585611efaf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d721dabb-1227-4916-98cb-65ebc9c74e76", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.165.214.60']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b42bbab-4a5a-4fe0-b833-29648af1bc0f", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.86.70.97']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd02ea54-ba3c-4959-a215-da9ba9f752ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.109.252.162']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f922b12-dae1-41f8-987f-cf5b5211df6c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.137.104.97']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3f0a93-fd0b-4085-8e69-b44a2b9d5395", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.145.109']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fe793ca-1ae1-42b7-ae3c-a4378c48ead0", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '3.82.141.143']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b7c39ae6-2668-49e3-b5fa-6205de92373b", "relationship_type": "indicates", "source_ref": "indicator--6fe793ca-1ae1-42b7-ae3c-a4378c48ead0", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf5c209-8967-40a4-a424-1148dd678248", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.58.247.197']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76b432f-14d4-4dfd-a4b4-0c3cb96133ee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.58.11']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66c6ff27-889c-4fa9-bced-84617103f6fb", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.234.80']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--48323f8f-2b11-47c7-a456-d2477c7e56f3", "relationship_type": "indicates", "source_ref": "indicator--66c6ff27-889c-4fa9-bced-84617103f6fb", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.125.156']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a3e7985c-b620-450c-8558-279b039bcd0f", "relationship_type": "indicates", "source_ref": "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7f9b421-acf1-4aa5-80f1-de0316daa7b0", "relationship_type": "indicates", "source_ref": "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e6c6ae70-90e4-407c-ba7f-6703b1a21e28", "relationship_type": "indicates", "source_ref": "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e024b7fb-3635-40ad-a71a-3876224aa4d6", "relationship_type": "indicates", "source_ref": "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.143.138.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--146a71fa-bd93-4ddd-acc0-ab8b54d10bd5", "relationship_type": "indicates", "source_ref": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e49eddc4-7a1d-40d6-b7d6-0322613a455a", "relationship_type": "indicates", "source_ref": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e31fb93f-b3ea-4534-8d0c-be13c11ff8a0", "relationship_type": "indicates", "source_ref": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3dd8e2ef-d03b-426c-84a0-313997412628", "relationship_type": "indicates", "source_ref": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--021599c2-b54b-4000-9326-4c643ae3b761", "relationship_type": "indicates", "source_ref": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.15.170.245']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--877cba83-26ae-4171-a2fa-e092cdd39741", "relationship_type": "indicates", "source_ref": "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--88df6221-1a42-446f-8883-fc32c6abb7ae", "relationship_type": "indicates", "source_ref": "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1f93ecc2-c148-4d31-9a8d-5f93bf6d4d93", "relationship_type": "indicates", "source_ref": "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ea7c4447-1316-4835-ab72-58d8b7a57308", "relationship_type": "indicates", "source_ref": "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--343448e7-1d13-4a2f-9f6a-3a21f20d97af", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.130.80']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fcf5ffad-ed78-4e64-805a-7de3e16eb143", "relationship_type": "indicates", "source_ref": "indicator--343448e7-1d13-4a2f-9f6a-3a21f20d97af", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79b8b322-7c4b-4855-9301-8e38ee70a17a", "relationship_type": "indicates", "source_ref": "indicator--343448e7-1d13-4a2f-9f6a-3a21f20d97af", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a304aa9-fcf1-4a87-b927-8fbded783aea", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.85.54']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b67d63d-fda6-4938-9ff7-b135762e3eb1", "relationship_type": "indicates", "source_ref": "indicator--4a304aa9-fcf1-4a87-b927-8fbded783aea", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ed858e57-2d82-4feb-b4cc-ed5657fe8fd5", "relationship_type": "indicates", "source_ref": "indicator--4a304aa9-fcf1-4a87-b927-8fbded783aea", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--556df774-2197-4290-9fe1-adb6750593a2", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.16.139.189']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8bee356d-85eb-44a2-9f36-e1da5316f733", "relationship_type": "indicates", "source_ref": "indicator--556df774-2197-4290-9fe1-adb6750593a2", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--468e7d7c-9452-4729-8604-c909e7bcce83", "relationship_type": "indicates", "source_ref": "indicator--556df774-2197-4290-9fe1-adb6750593a2", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57568de5-4812-419d-91b2-f6cf02976130", "relationship_type": "indicates", "source_ref": "indicator--556df774-2197-4290-9fe1-adb6750593a2", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eb017876-a1c7-455e-a619-8fc4a8ccc6a6", "relationship_type": "indicates", "source_ref": "indicator--556df774-2197-4290-9fe1-adb6750593a2", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "name": "Malicious Host", "description": "Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.16.62.37']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5806aa3-a72a-4018-877b-baded1b7c9cf", "relationship_type": "indicates", "source_ref": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e156018-5e0f-4d80-9bb2-69fd092455a7", "relationship_type": "indicates", "source_ref": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--947a9184-f452-4a23-8a91-f3056b9de36c", "relationship_type": "indicates", "source_ref": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--51939ba2-c0b6-49eb-9505-37a37a80ced3", "relationship_type": "indicates", "source_ref": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--402a828e-3c54-4240-ac95-1380100b69d7", "relationship_type": "indicates", "source_ref": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "name": "Malicious Host", "description": "Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.171.80.90']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--174cc6a3-5b8e-49bb-a567-f095d8eef145", "relationship_type": "indicates", "source_ref": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--63a43f96-6029-467b-aaea-c8aa332a5502", "relationship_type": "indicates", "source_ref": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ea006f6-9e0c-466f-ad08-696cbf387eaf", "relationship_type": "indicates", "source_ref": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--05c86238-d5e1-46d9-ba87-638b62806c58", "relationship_type": "indicates", "source_ref": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6baf3744-5ae5-4096-b453-9d1b5d1a5c2d", "relationship_type": "indicates", "source_ref": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.21.185.17']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--719925ea-047f-4cef-ab53-8872977c1a67", "relationship_type": "indicates", "source_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--17b8a11f-7d1b-4ef3-a8e2-73bacf0285f0", "relationship_type": "indicates", "source_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9c168d18-f3a3-4b0f-9f2b-8d0b2e6c00ef", "relationship_type": "indicates", "source_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f668672-5e3d-492a-8bd5-224dbe892734", "relationship_type": "indicates", "source_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd26a38a-efb1-42ad-8ef9-34b9ca8dbdb7", "relationship_type": "indicates", "source_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f8343fb8-d0d5-44c3-a04b-08058147da91", "relationship_type": "indicates", "source_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.21.186.235']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--73513656-4018-4a19-a227-cf47f561b642", "relationship_type": "indicates", "source_ref": "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0910592a-6264-4b75-b311-4ec95e23e6b3", "relationship_type": "indicates", "source_ref": "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef5f29e7-a997-4ad9-9bd2-535e8fbf248c", "relationship_type": "indicates", "source_ref": "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd5d2bc5-ed88-4e05-991d-e0e8ffb90788", "relationship_type": "indicates", "source_ref": "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.21.239.151']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--236df2dc-5855-4135-8b02-25ec32745603", "relationship_type": "indicates", "source_ref": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2acc5ecd-47bb-43fc-8e79-e3f64e224337", "relationship_type": "indicates", "source_ref": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--459acf77-3638-435f-9c43-01c3bb159a8a", "relationship_type": "indicates", "source_ref": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ca4bc233-d8d2-45de-8eec-4623fd91962c", "relationship_type": "indicates", "source_ref": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.21.62.0']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8a7e3c69-a05b-4524-9ea7-c00f832d046a", "relationship_type": "indicates", "source_ref": "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--784b5cf3-662e-4955-86cf-1d1ff9301e03", "relationship_type": "indicates", "source_ref": "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f97d8dd-7fac-482a-a663-8fcc5c4c2322", "relationship_type": "indicates", "source_ref": "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84cc36a3-e5f6-4ed1-8d2d-6c6958e15114", "relationship_type": "indicates", "source_ref": "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.24.135.198']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3071023e-6cef-4e22-bad7-63ac9594bc73", "relationship_type": "indicates", "source_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--adbef5a7-af43-4799-a31e-3794b5c00f68", "relationship_type": "indicates", "source_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ddb63bae-eb2f-430b-b7f9-1fd988e49177", "relationship_type": "indicates", "source_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3e557aa5-7e2b-4919-97f7-8ea3c555ba07", "relationship_type": "indicates", "source_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7075bb61-eb40-4e79-8b60-f31cbee6f964", "relationship_type": "indicates", "source_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3087a2dc-ae95-4fdd-9599-047608a1dc62", "relationship_type": "indicates", "source_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.32.112.38']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--92469197-5f96-4784-a32b-e7ea70f76e18", "relationship_type": "indicates", "source_ref": "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ce866ebb-074c-46fc-a5c8-9dfc8c829338", "relationship_type": "indicates", "source_ref": "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--77bc36e6-3097-415a-9056-3179f9b4c9e8", "relationship_type": "indicates", "source_ref": "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e0ccbdf-5385-4f01-9703-d4f5dd170316", "relationship_type": "indicates", "source_ref": "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.35.103.165']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62a06a0b-5480-4d2c-824a-40a79fa8eae7", "relationship_type": "indicates", "source_ref": "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7ffddf8b-95b4-489e-9bf4-b40e26d72afd", "relationship_type": "indicates", "source_ref": "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f376caee-4c3f-4a83-8633-cfa2cb6d9fab", "relationship_type": "indicates", "source_ref": "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af6c7edf-a3a1-4d83-8d4f-4925ef6c03fd", "relationship_type": "indicates", "source_ref": "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.242.214']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8217ff1f-4d0c-443a-8018-c6a5cb3021aa", "relationship_type": "indicates", "source_ref": "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d2656ca0-70f1-4205-981b-aa2c9de28ebe", "relationship_type": "indicates", "source_ref": "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8006546b-0423-4617-8029-8e8a9085f96b", "relationship_type": "indicates", "source_ref": "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c2cb73fe-68b3-41a1-be56-f1505f72b486", "relationship_type": "indicates", "source_ref": "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.44.236.95']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bff1097e-4221-4352-9a82-39f269c1829f", "relationship_type": "indicates", "source_ref": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--680b25c8-977a-4461-88a7-a6d4e70a2f66", "relationship_type": "indicates", "source_ref": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cd607f8b-1da2-4147-9e82-e4eab23e3986", "relationship_type": "indicates", "source_ref": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f2b8489c-d893-4d9e-ae4e-a63b90461d7d", "relationship_type": "indicates", "source_ref": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bee5d1b2-fd11-47fd-87df-ad3bb21aee5f", "relationship_type": "indicates", "source_ref": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.46.114.222']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4ecb0aee-31fa-462f-a66e-f0bdb8c27030", "relationship_type": "indicates", "source_ref": "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--282fb25b-8f2e-4dfc-9efe-b4b4046fd469", "relationship_type": "indicates", "source_ref": "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ebfcfa38-d38c-46e7-b991-648a71fc47c6", "relationship_type": "indicates", "source_ref": "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1370adfa-199a-4f4b-926b-555608728dda", "relationship_type": "indicates", "source_ref": "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--650adda1-371c-44ee-aec0-6be04367af01", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.50.49.106']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--262eaa16-eb28-46c5-827c-c54600bfdd68", "relationship_type": "indicates", "source_ref": "indicator--650adda1-371c-44ee-aec0-6be04367af01", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3c32094-9101-40b6-94ad-fb3f1be9df0e", "relationship_type": "indicates", "source_ref": "indicator--650adda1-371c-44ee-aec0-6be04367af01", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--25b13690-5c85-4002-8415-d939287473ec", "relationship_type": "indicates", "source_ref": "indicator--650adda1-371c-44ee-aec0-6be04367af01", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--adaee552-bd46-4d9a-894a-8b0ad9d3d70e", "relationship_type": "indicates", "source_ref": "indicator--650adda1-371c-44ee-aec0-6be04367af01", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.51.131.94']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d56762fa-6c1e-4c16-8875-b6d47801bce3", "relationship_type": "indicates", "source_ref": "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f766333f-ac2b-4ad0-9132-6bb3d8918773", "relationship_type": "indicates", "source_ref": "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4bddeaef-a329-460f-8a93-b59e56c86a65", "relationship_type": "indicates", "source_ref": "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--622c661e-ba88-42fc-a93d-bae067c6e532", "relationship_type": "indicates", "source_ref": "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.56.177.125']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1295545e-3aa7-401b-8728-0abf59ee912c", "relationship_type": "indicates", "source_ref": "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5be05c67-b693-4e21-a481-9cc9897e91dd", "relationship_type": "indicates", "source_ref": "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d33b9474-1567-4593-8bc5-89037a4c2977", "relationship_type": "indicates", "source_ref": "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8f0982a3-2aaf-4c91-bd76-0270214d09d9", "relationship_type": "indicates", "source_ref": "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.136.180']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--06d7d4ea-5bae-45a7-8448-0d8819a17ebf", "relationship_type": "indicates", "source_ref": "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--413b401b-a74e-4130-9b0a-03ab690d300b", "relationship_type": "indicates", "source_ref": "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6ec7f758-42ca-4d3a-a5b3-7ba4e0df44b8", "relationship_type": "indicates", "source_ref": "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4884bf8f-2432-4224-b391-6c8425498187", "relationship_type": "indicates", "source_ref": "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63331dc1-38cb-4e88-86c1-13f921e8b02a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.16.76']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73810339-f8c4-4aec-98b5-acd6f28e6bdc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.116.107']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.90.185.172']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f41be977-fd59-4006-9b47-41b03fd35f44", "relationship_type": "indicates", "source_ref": "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23f12edb-9a25-4fba-b540-5609f0967624", "relationship_type": "indicates", "source_ref": "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ad5ce8b1-1df5-4b2a-a9c6-c4e6a4cbb005", "relationship_type": "indicates", "source_ref": "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "target_ref": "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--894d30de-716e-4f81-8f36-5d20ccd65e4b", "relationship_type": "indicates", "source_ref": "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "target_ref": "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e56977d-81a6-4655-b5c3-0b07ca513de6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.92.164.92']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8c3bbf-9119-4c37-b590-26c44b72b5bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.93.212.106']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--498610ab-706f-43cd-8a72-eae14a2170d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.153.221.203']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bdee8f4-57c4-48ad-8de7-5be074311a0a", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.238.59.99']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bee43a0-41ff-480f-b0a8-a3bd684d6b82", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.58.49']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f392e4d-b106-4368-8cae-b721b973a253", "relationship_type": "indicates", "source_ref": "indicator--0bee43a0-41ff-480f-b0a8-a3bd684d6b82", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca00b4ec-7827-4c36-8c4c-f2d0f74b63c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.246.34.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--277fa4e7-c13f-4df7-ae14-734f123da708", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.66.209.66']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ddc0a9-ee73-41a5-a2f6-c67ae44f6bf3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.92.166.242']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--622c7fb5-e56d-448a-94eb-48e78fec10f6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.93.249.106']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d29f14-bc28-4b05-b6e6-34769a6b1bbf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.34.138.115']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106fa3c8-a5b7-4d29-82db-5c8f590540df", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.41.116.113']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5fb6ccf-aee3-4d06-8136-b41837c3adb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.34.188.67']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81fce22-f244-496d-bfbd-76d01b467e94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.96.71.26']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99532b6d-fc4e-4563-a58f-622d3a5e4d83", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.239.240.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ed42bff-a5cd-4cb8-82d2-1c7de8a1365d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.116']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2127ffd-6d4e-412f-bb73-8d4c35506299", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.132']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2521b0b6-cd78-4ad7-89c4-94ced849abc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13af3df7-97ca-426b-927a-37fa3a2d072f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.18']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88e190e2-d734-4a1a-a97e-543be371f6f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.28']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--660b1b9c-5df2-4f7c-9ba9-423caca34268", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.38']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f066c6ac-0501-4b05-8a7c-0e32e4efe7e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.4']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05bb6ad3-dfda-416b-9626-b5d4894726d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.67']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--552ea42b-da46-4a9b-bcb8-49e858042f7d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.70']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d170d332-a6ab-4b5a-bcce-49f398d5566b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.73']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3302c103-5a5c-4ee0-9971-aa6ce3128ad0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.173.43.34']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c3e75d4-757c-4007-8cee-6a63c6a52b03", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.204.75.94']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb647e89-f1b6-4a31-8558-eb673d75f7b1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.216.167.226']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--697b9932-b52e-4cd3-8529-8c99c4c4fa04", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.216.178.119']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc8977d0-ca93-405e-b2e6-24b809f43d85", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.56.251.107']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e906413-5203-480f-a604-a6830373fc72", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.93.28.11']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdce0a57-a5b3-4cb7-9568-a51d0e8bdd35", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.94.111.190']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c497e01-ed23-47a7-ae74-60b4f2d9dd83", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.200.158.230']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--536f435c-c1eb-4475-9512-7e0d06f594f2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.227.204.90']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53a7a0e0-6c17-47f7-bea5-1c804e905606", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.96.19.37']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2acd8dfb-16e3-4020-a22b-ee588fe5438e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.71.228']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5623e5a2-88c0-4a1d-a821-e9ea271f93e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.129.161.181']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40891bf3-83a3-4105-a5a4-dbd82da25ba5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.129.196.140']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e960e7-0824-4f2a-ba22-fe7918f116fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.101.151']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80550142-8236-4424-b216-a4fdb0a35175", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.135.243']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4db7eda-56d2-41f0-883c-891ca0a8b214", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.139.177']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a229dbab-bec2-49f6-be66-810b0ffdf840", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.26.3']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30dda65a-3aa2-4d34-8770-4beb4f61244d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.3.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea725af6-6b2b-46ef-842a-f98acb31329f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.243.61']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c586095-6c12-4639-aa41-b57a0f4e6614", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.222.70']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23821cb3-0eab-4a77-939f-5bc2336611e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.14.73']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4466b7-ed85-47ea-a0d8-b0ff78329196", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.233.56']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b77c0f75-0744-4047-bd34-bd67d04b046b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.5.87']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afa6fe42-28f2-4757-ba95-26b086274208", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.72.134']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d62a0138-8286-4a03-aa13-5c9588c079aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.87.44']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b5ac460-a081-45d9-bcc2-3cf2365ff6d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.149.24']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8030b229-bd78-4181-8d82-0d6051b740ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.194.220']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ae4c81b-2657-4fbd-a2a1-68368cbe2455", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.205.159']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--842c529c-5de0-4765-a54b-812745e66526", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.6.72']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd70cfb3-0aab-4bae-be16-8d7292c61aef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.154.138.234']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d3416d-6e6f-4c37-8881-8153fe3a6021", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.100.222']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cacf7d86-ad53-4276-b168-224930b0fc74", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.102.152']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5397e75b-83fc-4f29-94a9-56ee804d758e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.80.123']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be898d3d-d71b-4266-9942-7188caba2f00", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.18.111']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711fa530-4d7c-4443-a9e1-517e01a647c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.180.116']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de7102fc-3025-471a-bbb6-7aedc49e9e60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.181.189']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47db25bb-6590-4795-bf1d-f9663533d978", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.47.56']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ad5e872-93f5-455c-9af5-c9cf57494abc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.5.205']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a3d7a54-bfd0-46b1-9c57-4320233963ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.60.231']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f5eb59-393c-4d83-88d5-8327467a37aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.84.238']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34388293-a717-4efe-8f43-a486b397d41c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.130.169']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dc5e19f-f09a-42fa-9f90-3b8bd6fb11c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.36.180']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd265600-20ef-4a90-9a13-9e0ab3394db1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.54.246']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d56358-051c-4cd6-a76e-f3df4c2abf80", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.160.204.7']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4e2e13b-94fc-4f52-9cf6-dc039499db70", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.6.201']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81011f94-0fe8-4d92-80c9-8728c95971d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.196.244']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616dfacc-1d05-435e-a54c-c40bb348a488", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.136.153']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f17163d1-8536-42d9-b7bf-5c1ffdfdbd2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.240.100']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6fbb68-2f3e-4ab5-bc5d-3a38b341befb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.244.156']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c224b8-ca60-4b80-9aac-9af9599c2c7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.172.30']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15f18ee1-d49b-4c9f-8514-81ffe1595a20", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.196.223']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b49486ff-a8a6-4940-9c27-12c3b1326f9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.213.95']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6832276-38ad-4548-960e-0abb04fe3c7a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.214.233']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b63fa6f6-de23-4a72-ab45-c24a3d52189a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.134']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0c8657d-8cef-4163-8920-30fb797961c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb3dd51-4e9b-4501-882c-13128328129d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.223']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a1faa1-3948-4659-b044-9776f6b7922a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.12']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f24cb4d-4bba-48e6-b27a-2daab81f72f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.201']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a02703a0-f795-4025-8ada-220517ec0dd6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.209']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66df543a-8dd3-4523-9706-f2c4b3c88a5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.196.108']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6028bff-2880-4abc-b13f-df42a26e0859", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.196.126']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36642815-8f1c-43f2-9a23-70718deecd19", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.196.217']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e41707-8229-4143-8617-5e46369f8f35", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.181']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--723342a5-7288-48dd-8f8b-c937b0c2f628", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8dea7e5-5f6e-447a-8e17-1c532ca07e38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.63']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3421831-43f0-4e80-addc-8a05f27469ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.202']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a963dcb-9971-4265-b6e5-419f2101eb9e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.223']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfbf480e-5d59-4379-80db-f92e5157e34d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.233']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--935aeaa7-aacf-414b-a113-1122bc80d7e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.198.74']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab54784-0566-4f9c-9114-2213e9c29bed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.8.79']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f30a51-2ded-4c19-98ca-1cf1ca28c7be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.1.69']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2200a46-ded7-4fcf-83a2-2e79dc3e6830", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.132.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0af34594-187f-4579-b908-544348de7fbe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.206']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f93efc-4c96-4e82-8b0e-d7316fcd73de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.236']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--353d16d9-1bc9-4521-b290-f4acf685a1b7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.67']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9130ce09-a70e-436d-82ac-320cc0ce9e90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.80']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035a27ad-1213-4d58-89bd-e3e0413edef9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.104']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05187367-fd03-4188-af79-6925a16257e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.144']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6d2c37-061b-42d2-8ddf-ab242361f884", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.175.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dcb1633-8a7c-4e5f-8161-c395c8616af4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.124']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149e61b2-f21f-4a13-90d9-ad1456dcb9a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.163']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69350fda-5b59-4b7d-b710-52d0f64db249", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.241']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5da7ac3-7347-4dbc-98e2-b801aebe08ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.177.196']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a53078f1-f24d-4e77-aa60-8452ce0726c6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.177.35']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276bcb49-e40d-48c8-9104-f8bbf5ec6a7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.178.200']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e649d35b-f5cb-4f9c-b130-20eeec9b139d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.48']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d462583-d084-47bf-b837-44023deed221", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.169']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70905438-38b3-4a02-af16-b164a8951a95", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.241.37.251']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43fcc3dd-1fc6-428f-be31-5be26eff15f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.117.156.109']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4716c5f-e01c-471e-812b-74c4d7e6f4e2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.119.85.159']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c67068c-9621-445b-bc9f-2471eee5250d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.122.220.193']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c58aed18-6489-442f-8576-f1c0c313e541", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.24']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c051d6a-912f-47ee-985d-cb11e9c21c22", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1c1351f-944b-46c4-ad1d-eeff5cb57ea5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--771f6464-b75f-4bd1-b214-7f713eec2018", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4dcb7e0-4b5e-4e41-a758-25a0b7abc37c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f86a868-87b8-4082-a230-0e2aa565a916", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.59']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15897449-ae39-45b6-aa20-7bb7db9dd8f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.62']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf658c7-e683-4b5a-95e4-ea493c83068e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.150.174.89']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--888d3dc3-da54-4a0f-8673-fd8ccb5ee5f3", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.150.174.91']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da9badb2-638a-4bee-a17d-a72c671bb291", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.17.39.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a3e1d21-28ac-4c06-b465-f5e53bc445e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.218.242']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1183a40f-ac2f-43ef-8f9f-01bc86b017e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.231.126.138']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02578c31-bb3d-414b-baf0-e18e263914ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.239.73.147']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.45.237.69']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c329b06c-6394-48c6-a7ca-83c9b81bba32", "relationship_type": "indicates", "source_ref": "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--659f26f4-a1fc-4fc3-a6c8-2c9fa6613e13", "relationship_type": "indicates", "source_ref": "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c5cc543-f4bc-43a8-a41c-ce05d7d8bbf1", "relationship_type": "indicates", "source_ref": "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8373ca44-07f8-4662-85a0-505e0b3ff513", "relationship_type": "indicates", "source_ref": "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b850a7-cddf-4fa7-9bfd-a3c2fd994b27", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.64.74.51']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7177c1b-e7d5-40b5-aa64-cc785f203313", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.152.14']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5530e0e-b7f2-4031-9237-bca75b5b63c2", "relationship_type": "indicates", "source_ref": "indicator--b7177c1b-e7d5-40b5-aa64-cc785f203313", "target_ref": "attack-pattern--1b9871cf-29bc-44c1-95cc-0588b915c1eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8afa779c-5b42-401b-9c0d-05f59bd89a16", "relationship_type": "indicates", "source_ref": "indicator--b7177c1b-e7d5-40b5-aa64-cc785f203313", "target_ref": "vulnerability--3dddb23e-3947-4513-9e5c-a23f65603252", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8a75ae50-518d-4de8-82c7-1fe74428efb7", "relationship_type": "indicates", "source_ref": "indicator--b7177c1b-e7d5-40b5-aa64-cc785f203313", "target_ref": "vulnerability--6d5a1c1b-9169-473d-8fd6-3c26128c7ed2", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3617e02-0ee1-43ea-87fa-47be936e8849", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.10.201.91']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26db2c32-aa2a-4af5-9a08-724c51917255", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.162.40.30']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba72da84-244b-4829-bb7c-2de1ac898b9b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.253.45.10']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bafdca0-2a91-461d-8087-e869b0fd37ab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.53.224.202']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df456f2c-71ee-4c76-a53a-bbacada1e13f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.70.207.20']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--205c9729-78a3-42fb-861c-42438d12ac43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.125.205']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1f37ac-1074-4f1a-99bc-36e5ba3721ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.197.40.97']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fef4b46e-dad6-42b6-8285-7d5e175745e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.3.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c4b9d8-ff05-47a0-9d2a-9a608301b0ea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.207.247.78']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf35bd09-1dee-446b-900d-0f120a6afc0e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.141.76']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc0213f-38da-44a5-8c75-1b6990f5fc2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.195.195']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5740431-3fae-4e87-a3b6-8e2d3a1b1ee1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.202.241.42']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3745789-94df-4ed5-ae77-9531ad5fcb79", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.255.98.143']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe6ac659-59bd-46c7-b767-360c19c20a52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.62.139.101']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb3299e2-c867-498c-9986-a8c31e4c28f0", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '5.75.229.155']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c08896c-a101-41b9-8ec8-aa38747fba27", "relationship_type": "indicates", "source_ref": "indicator--bb3299e2-c867-498c-9986-a8c31e4c28f0", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f8394778-538e-4f6f-a44c-58073b2113ce", "relationship_type": "indicates", "source_ref": "indicator--bb3299e2-c867-498c-9986-a8c31e4c28f0", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7374d64-2c63-4f83-98fd-09e5a354a9c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.89.75.194']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c13af42e-f03d-4893-8ac1-ffa38cf78b3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.195.244.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9368b4-4561-4d10-bbc0-8b66e3d41073", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.111.217']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89fb2b3c-b383-4bdd-aebc-da0daf85ed5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.8.102.13']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b45716-cb57-44ca-a8c0-7ec88da89d51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.8.102.83']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc93353-7afe-4e6a-90a2-74e214a61355", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.110.61']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62258b92-629c-43f3-b559-41f369e3c14d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5a186c3-f24e-4be6-855a-e5b5f7fa8d71", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.119.252']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e18bee-5bb1-4b61-9668-546ad4d72597", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.89.166.236']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aac70d1-e7c2-43c9-933a-dbd75e7165c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4591b193-2b11-433b-9057-2d4d29250319", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.147']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b88a5a5-b540-453f-b9e8-6257047a5e19", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.189']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84c5cede-7a3a-43c6-a7d8-7a5d9c38de85", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.199']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33b873e-0c47-4ceb-aae1-12362e1f4831", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.206']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf02681a-c871-4dcf-add7-626a033b413b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.208']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6810b7a6-6366-44d1-aefc-1123fa2aa924", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.173.67.116']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f147ab-ff0f-4e23-bafa-ed2395183b77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.4.140.84']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fec2809e-18df-4e60-b10b-d542c20fdd6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.37.118.87']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71af5e0-a83a-4c44-baf5-fdb66f8a434d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.0.42']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d785035a-1513-4e2b-afb5-58c76240223b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.103.119.35']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a77fdb-218d-4cd7-b0c4-116646e7864d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.16.212.232']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9cf2473-2973-4f0b-a103-91a7a7e4a454", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.19.246.157']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c84c5011-8a3a-41c9-9dad-11d06f7edf10", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.28.144.154']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--278bdca3-be4a-4109-942e-cfa5b2d216c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.174.17']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bbcc595-6c77-41a8-933f-ec9b9c76cee5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.174.148.212']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57766950-c112-43db-95d2-5154c27f9cc6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.205.111']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36b737c4-a2b9-4e37-ba60-58d497049bf3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.217.138.83']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea94379b-d725-40c3-be44-616bd8f3f817", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.117']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d66ab795-5a8c-4985-9068-05e5c2cba3de", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.201']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a479991-108a-47ff-b85b-689066453a96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.232']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7262872d-b229-4ae4-a321-c51e4799646c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.242']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f319e713-d6cb-4c50-b59b-d1f39ed02ab7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.253']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3148b789-d705-4fe1-a3bc-ada0e610d5c5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.84.120.152']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e45bc2-54e7-4d8f-826f-aadba5ba300f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.30.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433d3095-b782-4cb3-90a3-68ae0f6cdb32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.38.98']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bfb6690-6db5-435a-9af0-020ea9d8f10d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.160']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e2a8ef2-d2e4-4af2-b366-f08067da670a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.162']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7a3e34d-b271-440c-95c2-8e3b08594b9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.163']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--462f08a1-d2e2-441b-a797-8d446088a567", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.164']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8114b2de-6862-4b18-b231-1da7de9084b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.87.1']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7844ced1-a6a4-4242-a9ec-255033fb6e0f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.206.199.37']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c6f0397-c3db-4073-ab65-87ecf58ac787", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.206.199.46']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c2711f1-7343-4c8b-a1bf-d8ea8f8ee67e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.206.199.61']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b228bedd-35c2-400c-926f-583af52543fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.230.79.56']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab697c6e-6518-4eef-ae5e-d3f9b79f9b14", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.113.3']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d204625c-fa1c-472e-9712-1f74a47309c2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.238.33']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a29693-da6b-487d-aec0-8c6ba13da456", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '70.32.86.195']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0be2914-a512-4626-9e5a-2a4b2ed8c831", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '70.48.137.16']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afa56a1f-f060-4c45-a69b-edd9e792be71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.239.4.216']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b537957-bedf-484c-8442-3548cbca567c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.255.15.71']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9055fbf-4909-4c70-a2c2-9f412ac8700a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.255.246.198']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1159f2-2f95-4899-84bf-f6d26561b20d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.4.187.120']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d8b66c7-ec20-49b9-8e7a-8988bbc12cab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.227.140']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720b3aec-2a6d-456e-a539-877e8f1870e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.230.34']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df9d54d4-8ef6-4111-bb76-74d5f2692f56", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.242.34']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--637fb70b-e04e-422a-a3da-736c0fb9f58b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.36']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b314498f-da05-4f21-97e9-6744319af556", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.144.76.68']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f04b4a5-db92-4bef-9a5a-9835ccb79c5a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.112']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db4a589-4079-4f6f-897d-832933078d49", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.20']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58db5632-643a-404c-ac0e-4a1133940c94", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.27.115.34']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3885541b-2cc2-4f2c-b410-1637d1ea6641", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.126.114.30']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f82471-86d8-4f55-becb-21c0ef90fde1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.160.173.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76d06f28-89c3-4db6-800a-166073b72eb5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.210.93.171']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45f8542e-312c-4b82-b7b2-1c1a9fd75766", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.217.145.188']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5737c15-bc0c-410d-9033-659d671ce7eb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.222.204.16']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e473d1-8646-466e-9b9c-0859c7e6b305", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.46.93.181']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--859ddf9f-5449-450a-bb79-cb5b7dfaf9f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.65.208.2']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e326ee7-db55-4143-ac60-255c5d0e9594", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.55']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.211']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--95e9f542-e80f-4ce1-88f5-5ba8f4b9a37b", "relationship_type": "indicates", "source_ref": "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "target_ref": "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5001960-ad3a-4bfe-a9c3-b11cf8953a4b", "relationship_type": "indicates", "source_ref": "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "target_ref": "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a9fcba81-38d3-459e-a4ae-c378fc813e57", "relationship_type": "indicates", "source_ref": "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fe9ea90a-850a-4133-a9b5-2322385a4100", "relationship_type": "indicates", "source_ref": "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "target_ref": "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06ed415-4593-4b68-9c14-ba1507a5ef34", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.0.212.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73a0fdf-e2ec-4c41-87e0-421b872d8444", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.71.101.51']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef10b2a4-7771-4021-954b-fc8a98031db3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.126']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e785d3c3-b4d6-4feb-88e9-7e5a0891d9eb", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.190']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef738523-ab44-4f7e-bc36-01b6482acf34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.208.113.19']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33375e9f-cea0-4b16-b721-9bcb08879e19", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.44.39.47']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--994aa906-cc4b-4f00-ac62-826cc1ecfd1c", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.113.44.142']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1978240b-1de1-4519-8e4a-44807b104711", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26edbd14-7f6f-47fb-bdb6-097dafc266a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--591288fc-922b-4027-8725-32c48eb45a4c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d89bf381-48bc-4d4c-9faf-c34578925acf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18b02ba-28f1-4e17-967d-c72f14f4bf87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f904b7a-40c6-4d8d-bd94-3bda4c37e94d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1147f8f-8862-4545-b001-fc67cf7fdd7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94692b65-12a5-43c5-9d43-b25b4f78daba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--870a34c4-3227-4b45-b018-827f0cb41960", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1978d0a-1dd9-4922-aaab-2df571480a40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a61cda3-db91-415e-a529-bdc204e0db61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9828a83a-2f98-43ed-ad40-c2ec3432d4ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a95ccd8-46de-42c6-8f06-a26b9c7a5243", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--156406e8-5a78-4363-8aed-21855da262d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc17156-0f61-434b-943e-ad1ffca82bd1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d1fb49-5218-4325-85bd-ad9febd0f53d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef222fa-d9ce-4d12-986f-c2edd23c51f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2317250-d96e-4e39-971d-9cc9e23c36d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72fcd580-50dc-4d2f-a42d-47c589a0f426", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47afc981-7a46-4ff8-b884-4129d2962b24", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb756a73-1fa4-4357-9262-56fec3d5fee6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.2.38.131']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c753fa5b-8d36-44ec-a52e-5986b970a223", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.25.131']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e58df8-4199-4fe9-b9d3-608dcb03dcff", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.106.87.87']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd843fa9-1761-4841-82eb-20ae9e24f8b6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.108.74.178']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e746b26-1745-404f-bc53-4c625c6ed0cf", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '89.117.104.13']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee33ccc7-73fc-4a28-981a-7cb80606332d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.242.75.194']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff22444-41ba-41a1-a447-bb03013c45b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.249.63.6']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ae9469f-10ab-4c94-b548-36c13c782fca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.158.37.141']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8943f8-b23c-4362-ae8e-067effd6d411", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.48.234.158']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a084835-4d46-4e95-8e36-256aebd585cb", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.87']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--be62c65d-19aa-4a92-9fb5-d18e6b60ad56", "relationship_type": "indicates", "source_ref": "indicator--0a084835-4d46-4e95-8e36-256aebd585cb", "target_ref": "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--802c0e4d-2b0d-4024-bcb0-c289cc2856a2", "relationship_type": "indicates", "source_ref": "indicator--0a084835-4d46-4e95-8e36-256aebd585cb", "target_ref": "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--13b54936-1ca7-4b04-ab80-af757623d17e", "relationship_type": "indicates", "source_ref": "indicator--0a084835-4d46-4e95-8e36-256aebd585cb", "target_ref": "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ad6f62f-cb08-4a82-b6ac-7c8d986d8a4d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.236.224.37']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85f9e9ff-30bb-4bbd-b991-81ada1701dc0", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '91.239.157.185']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d8230b-d792-4cee-88c4-8ab9cb3dc53c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.241.196']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d4d326b-7265-4924-8de9-3f89f4650afd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.93.57.195']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa47ceb6-aa37-4deb-828b-7c789477d02d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.36.72.255']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d52be6d-4669-4bd5-b7ae-96782c313ac7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.30']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfc0d836-63ba-4d22-b47e-75fbf4a64036", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.126.56.226']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbfb4d85-0dc2-4041-85f4-e769e91f1cdf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.99.104.213']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5627ace-354d-4e4b-985d-586aafc0fd95", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.58.221.186']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5881aaef-e1f0-413d-83bf-480bcbc1d2e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.85.245.227']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--738399a7-47b1-47ce-ac34-d1ae362f6d64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.115.222.148']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a84d930b-bb51-4b53-bcae-585c99feeeca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.70.48.241']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20cf1ebb-4dec-4373-a108-b5d803f9d104", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '98.98.33.5']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a1dcb25-0cb3-49d9-8183-baf086a4a8e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '99.226.136.104']", "pattern_type": "stix", "valid_from": "2026-09-20T00:00:00.000Z", "valid_until": "2026-10-20T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-09-20-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d4bb35-3fc0-486f-ab65-f30165c5afaa", "sighting_of_ref": "indicator--6cf117a2-be91-4d65-b0f1-b5e4183bc521", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a04e415-c598-48c6-950c-1d5b616d06c3", "sighting_of_ref": "indicator--b88d95bd-c8d2-4f80-bca8-e5c27638e297", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e04d541-7e65-4a2b-89d2-75c62ae2ca39", "sighting_of_ref": "indicator--9f8e2aab-eca0-4f56-9c8d-33ebc12a196f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0fe5ad7-fb56-429c-85f1-7c42eb1653ad", "sighting_of_ref": "indicator--698166ea-07af-487b-9437-14debbf8aca6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc498d54-1209-42a6-af04-6232f2ebe139", "sighting_of_ref": "indicator--3b006395-e2ea-4be5-a66e-33e632d4e992", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3838d7f-40db-42af-93eb-1023ffb1215f", "sighting_of_ref": "indicator--c7f988f0-46af-4d74-b202-180021a15df7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ea6ee8-e321-476e-ba73-2bcebad4977b", "sighting_of_ref": "indicator--f47119e7-ec71-43ab-a867-786b38044570", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc8ad747-53d3-49bf-858a-887792b4afb5", "sighting_of_ref": "indicator--2f9c5f50-8a0c-433b-95b6-12ec7fb34f45", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86735c3d-4d36-4e1d-9341-ed28f6d9532f", "sighting_of_ref": "indicator--de091230-87d7-4418-bba4-1cb148c92bc4", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d2742a-8cb5-4554-8b5b-8ad85638d232", "sighting_of_ref": "indicator--5eef3da9-8f69-42c0-b026-f4ea12c7cb3e", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6778cbe-66da-4487-a841-9e285bb70128", "sighting_of_ref": "indicator--ff0e0d71-47ed-4288-99b6-5834ba964f89", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cd5c610-8401-4b07-94c5-f7c10726decd", "sighting_of_ref": "indicator--f8cea7c7-221e-4618-8367-02b03f3579d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9764881-4430-4508-ba09-b8f70df53d5d", "sighting_of_ref": "indicator--b409f0d0-d820-4885-8428-dded7cda1e59", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f32a6e1-0c3f-479a-ba3d-7e8555386fa6", "sighting_of_ref": "indicator--8acc059d-2a3d-46ce-9beb-06455c2aa772", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d4f4689-88e8-4515-a234-f96d80856b40", "sighting_of_ref": "indicator--e3328aeb-feba-4c08-9f72-231330ad18d7", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aafe897-c7a0-4dd7-8463-98c41769c383", "sighting_of_ref": "indicator--c9fce473-ae0f-4968-9e9e-5e238f842a57", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49e31366-5171-4efe-a9a8-c59921e33bbe", "sighting_of_ref": "indicator--c51fcd1d-21e3-4468-823f-beab17e73c7c", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef64be6-52b8-4354-a007-b89654125c80", "sighting_of_ref": "indicator--9777f07d-4890-4497-a0f7-c24285bf3e86", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa31d286-d3bc-434a-a0ae-583d719e6f15", "sighting_of_ref": "indicator--031c5112-2556-4b46-9498-0a6fe721de42", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb8506e-3e32-46f1-ac75-5bce5481cc69", "sighting_of_ref": "indicator--d387cdf6-3293-416a-8582-36db8b21c233", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3f0118b-13a7-483d-a468-27e297c4dfc2", "sighting_of_ref": "indicator--0340928d-0c57-4b58-bc73-f71d0dbd55a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efae85b4-a4a9-46b1-abb1-c1a8f924b7d2", "sighting_of_ref": "indicator--73f4f800-1d28-456e-b0de-f3c102dc688c", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35ebcefb-d49e-4366-af4a-0ac1efa4e70b", "sighting_of_ref": "indicator--92aa6a96-92a7-46c7-88bf-e8ed580f0eee", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d1b43a5-4b9b-4517-b6ee-c1cdacfe2d75", "sighting_of_ref": "indicator--aa3f22c3-7b92-4e8f-86f1-f985b2645094", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c864522-3d35-4f71-8824-662eddb8d996", "sighting_of_ref": "indicator--a65343be-c810-456a-a9a3-b4c8b65c5e2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20330c2-5704-43ed-aea2-080a1ccb4bea", "sighting_of_ref": "indicator--ce3e0aa2-7ed8-4c79-b76b-5247afc2c744", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b947b61-a846-4c91-afb6-97c25ae51d7d", "sighting_of_ref": "indicator--9e0945c4-e4d3-4180-a8c0-c304300d8175", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8767c68-faa2-40e5-b8dd-9605866e34ed", "sighting_of_ref": "indicator--9e0d70cd-68b2-4d20-ae3d-51d9e2c2e7c4", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613a6594-2f55-4332-9600-086dd3ff5f7a", "sighting_of_ref": "indicator--0707adaf-7ffb-4bdd-9a45-5bf99fe489d2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc0d1e07-8ff4-47e3-bc5f-e50e4c370ef4", "sighting_of_ref": "indicator--ddb52174-8f31-4e88-85e9-780720a35c57", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93550106-e3d3-4046-92c6-9d1b9f885539", "sighting_of_ref": "indicator--ef04743a-5394-40e0-ac8a-b0e0a67dc1d2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8da2444-568f-4b62-8361-1f334dea4bd4", "sighting_of_ref": "indicator--43f2a8da-8f3a-4e9e-ba36-ced956a63e83", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d88d1c6d-4f8c-4e77-90d9-a72403872f38", "sighting_of_ref": "indicator--9ab2f930-5335-4d56-a530-f6bd749c6157", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3439e035-9842-4bfb-809a-5e22331f4759", "sighting_of_ref": "indicator--7dc06c59-2b10-4cae-aa86-ad8b6640887e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bbb1f88-1d21-496b-b2fa-403970022ae2", "sighting_of_ref": "indicator--1f9795d2-18ea-46c5-b022-cfa412c64280", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--839385e6-bafe-4a97-945b-18f9bb68dd28", "sighting_of_ref": "indicator--5a050ed9-abd6-4e8e-9b9d-a650740c2708", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d8c987-e4dc-42c3-b509-d0bdf2376dca", "sighting_of_ref": "indicator--dcd6fa2b-086f-4b38-9382-cdbc94e9b8bd", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc44e89-7cfe-4a5d-a2c7-9c7851206181", "sighting_of_ref": "indicator--3aa013f2-e258-4e08-a28f-0693601c49ef", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30787166-0f69-4478-9908-0e2737626ced", "sighting_of_ref": "indicator--75bbd90e-6906-4ffc-8c56-6f076773db52", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339274fc-73b9-43e4-bf0c-4c4d716e6304", "sighting_of_ref": "indicator--1195b225-5758-46cd-9125-d2d916a842b4", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c31d7bbc-bd2d-48d4-ab37-a4453f81d8fb", "sighting_of_ref": "indicator--62ddcc1b-a7ef-4528-b2a7-16434a127b98", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6999a66-5c28-4753-a3f2-da517eb4e865", "sighting_of_ref": "indicator--eb8e0d5b-bc00-47d9-85f4-b1351b0a5d68", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb929bc-be35-4b0c-9cf7-cb13655a5b99", "sighting_of_ref": "indicator--ad8bec40-aeb1-4c53-87c6-69003870dc8d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6addebc-17da-4bed-9066-c5b2015b55a2", "sighting_of_ref": "indicator--f091668e-d31d-49ec-814f-901901b8529e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bb6de85-63c6-458b-8413-1369408a5e81", "sighting_of_ref": "indicator--a2a0970a-d224-4823-ab40-8331d24f021d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79a8971a-17ce-4ceb-9787-da24b7562f72", "sighting_of_ref": "indicator--8fd60041-fa77-4c0c-9b9b-d7022a20a911", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bf232e5-540c-4962-bbba-d841d2c434b3", "sighting_of_ref": "indicator--98203c02-5de4-43d7-8638-e8d1215d06e4", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a85bd391-bc38-4249-a80c-c760e6c77c5f", "sighting_of_ref": "indicator--666d9871-f6cb-438f-9eb8-ef19eff6c1a2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c905dffb-9df0-46da-92c8-d93c9a807fb7", "sighting_of_ref": "indicator--bd3c2b7c-ff98-49b6-94e9-1d165db7f8ed", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b2d33a-b217-481a-96fb-6fd32300b3f5", "sighting_of_ref": "indicator--41f56526-4f25-462b-b25d-c59785cbe836", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a48e6e-81f2-47e2-a7e9-70509a8bbc76", "sighting_of_ref": "indicator--857736ea-6421-4eaf-8d8a-cee5b00eb0b0", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--887dbc79-5c38-4b7c-911f-069578540ffc", "sighting_of_ref": "indicator--6c8eadf8-002b-4967-8dad-4a8f0d51780f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a383999-c16d-47b3-825f-1afda9d2dd4f", "sighting_of_ref": "indicator--9f1de9ac-2a9a-4764-a087-d31bb5e339e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4183f81-180f-49a0-90d6-95a7128ea223", "sighting_of_ref": "indicator--eebd673c-c9d3-45ae-a1b5-f6bf9d4329c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6ab2eb-8db5-4bbd-b7c2-dce7cc156ea5", "sighting_of_ref": "indicator--22327f65-ef13-4628-a26a-f5a14484ee22", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44819d6d-c90e-46f2-b7ed-19a3e9c9a485", "sighting_of_ref": "indicator--2356eabd-76d7-4504-bc39-4c1ce763988e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a8f7908-24e3-4d71-8895-1ba4645a0eee", "sighting_of_ref": "indicator--40f32bb1-bbcf-4b9a-894c-b56648dda3f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ef31000-fcdb-4e10-9dab-67b29ccba827", "sighting_of_ref": "indicator--e3932dbc-2aeb-4a98-b074-250055612c9b", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bef8d38e-48d0-430b-a913-579779442808", "sighting_of_ref": "indicator--a0dd7164-ceb6-474c-b9fa-e6a01a0e142c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--844cb0e2-ec4e-40b2-865c-3e0f8d1a7804", "sighting_of_ref": "indicator--c52136f5-3041-45d9-a4e7-9e29bb991520", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--664868a3-8549-43d3-8684-8c5d362f0f92", "sighting_of_ref": "indicator--fe7f9451-5da5-40bf-bb24-079a322a7178", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da425e7e-02e9-429b-88e1-daa7f2426ecb", "sighting_of_ref": "indicator--23f61faa-574a-4b89-a2ab-524deb4c4c21", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--620a1ef3-a2c9-4249-ac41-38605f058ea1", "sighting_of_ref": "indicator--b5c46029-ff85-4d2f-b8d1-091c138f0f60", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ce4a78-2840-4b2a-9c89-e91895dd2bb2", "sighting_of_ref": "indicator--1a686b21-7b65-4c67-99be-a8e58d3506e7", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35da484c-d777-4f20-b881-af78127f8404", "sighting_of_ref": "indicator--3042ac25-3afd-4817-b469-9eecde24583a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb62003c-3708-499e-8c83-a30c87c69c01", "sighting_of_ref": "indicator--e5adb9d3-abce-4cb6-9903-ad579a031420", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcf2b3f5-4531-48af-a2d4-0a9665611a4a", "sighting_of_ref": "indicator--4b7e7d1e-47f9-41bc-86c8-31af8430617f", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a69b2b-26b8-4003-b394-85574fabb78a", "sighting_of_ref": "indicator--eb2b16b4-f612-4bd6-8d14-0432c25c1278", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dca161b7-5691-49e1-a63e-d21d718b30e3", "sighting_of_ref": "indicator--617bd813-e87d-4040-9e0d-0ab187301862", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc55ee0-a28e-4e0f-821c-c218aa2573ab", "sighting_of_ref": "indicator--5062d239-1b49-4e69-bc5f-10165187db9d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ff03ee9-3bfd-4da8-a629-4f6034966a8a", "sighting_of_ref": "indicator--5a8281e4-1181-4709-a95d-c0fad0b41f8d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01541de3-bfbc-4014-817e-996fb7a181a0", "sighting_of_ref": "indicator--845af519-3f1d-4b3a-8a7d-45bfcf7be68b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--820c429e-3672-4cfe-abcd-b1b181498ea0", "sighting_of_ref": "indicator--40ef53ef-10f4-41cb-92c2-5133340d9925", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77993e80-a10c-4877-ae28-cc1cf77fdd49", "sighting_of_ref": "indicator--59195254-eefa-407d-916c-f4408372f1b0", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c69476a-1e9f-4d08-a61b-cbe838303c56", "sighting_of_ref": "indicator--f8b1e678-9dd5-4b7e-a218-7b066f560074", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b189c060-e18e-4ee3-a28c-c1e1c31f15f3", "sighting_of_ref": "indicator--de771ab1-5883-40a8-b6c4-01883a52b9b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae5c6ef0-4ed2-4c65-8940-078845918cc5", "sighting_of_ref": "indicator--1f7b3d57-6343-4589-a573-12bfb33cf7e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--377e0f23-def3-488e-8e93-71f8df6e53d1", "sighting_of_ref": "indicator--080be266-9573-4d1e-9853-7be803fe79af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f854086a-9ce1-4932-9f21-66c31335c55f", "sighting_of_ref": "indicator--00b8458e-1640-4c37-9c83-ee5f2d6e4b59", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c1077d-1dd5-4ad0-8d7d-227b2f7fffd8", "sighting_of_ref": "indicator--210a2ec7-86b8-491a-8c44-b9e4673c1d50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be9ffcd7-0f0d-4c4b-b033-b913cac17db3", "sighting_of_ref": "indicator--8297a6cf-83b7-4317-b335-611b96a546ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--454c4fd6-22b7-4edb-a8c4-a95a58fa8bc0", "sighting_of_ref": "indicator--bd66bbb4-df79-4d59-9823-ff5b53c48457", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc902e6-cd64-4068-91bc-55fa6805419d", "sighting_of_ref": "indicator--c7ad3989-f1fa-4ff9-aa37-3379c1ab8517", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6f0c868-13f7-409b-8196-00ac67b44ebc", "sighting_of_ref": "indicator--8942d043-e59e-4643-b14e-d281c218ad8a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3657a77b-5ad7-40fd-9ba7-4faf41e799a1", "sighting_of_ref": "indicator--1db1ea3d-bc14-4f24-8ae4-e020719018b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86425c74-b3b5-4154-87cc-86e28c6e3f49", "sighting_of_ref": "indicator--0e67d256-c84b-43e6-b9ad-0ca2c2449643", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18e2806e-c27a-4d63-843f-578fa8472dae", "sighting_of_ref": "indicator--3562b61a-cb39-4008-9c53-45ea54d77caa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1600ee-f3b2-45f8-8d76-e2f4ce38fa3e", "sighting_of_ref": "indicator--9bb7abc8-7814-4b2e-b0ce-b39a68e683c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1959b9fd-e30d-40de-bd2e-6e2ebc984518", "sighting_of_ref": "indicator--689786bc-c6d5-41fe-98bc-fe42060c0cb3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aea2373-e57e-4848-a6a9-a16b61540926", "sighting_of_ref": "indicator--59176fd2-0132-4836-9b5e-8f7a2d74b0c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c9c83b-8f90-4bef-b937-07856e289a73", "sighting_of_ref": "indicator--bfed579f-ed95-44df-ab85-916d0e7b5afa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0f671c7-e473-4544-ad3c-9a548b4b0987", "sighting_of_ref": "indicator--5f28c781-a8c4-462c-bbe6-911d51394dca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf356cab-3063-4487-9496-00703f098d8f", "sighting_of_ref": "indicator--f2b4d420-d4ca-46f7-b794-d5515cde580b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0dea86d-c8ab-4909-bdb4-da0b8f32fd92", "sighting_of_ref": "indicator--dc899e95-48c8-4e49-b566-732ff796be5f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a045721c-1fd9-46d2-842a-cf0f5eb18aba", "sighting_of_ref": "indicator--f70a6945-8859-4cdb-b646-e1591623541b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81b167f8-b14d-40b4-9bcb-22058091b45d", "sighting_of_ref": "indicator--07e83648-7cc4-47db-9ce3-bfbc5c853821", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898d4fe5-b259-40f0-88f5-be2481dce17a", "sighting_of_ref": "indicator--17ce0981-08db-404a-8759-e0c046c20f15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b722997-26c1-4730-9b69-736b6dd83554", "sighting_of_ref": "indicator--5a316ad6-ed0f-4f09-aac9-e2320121399d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b253ba55-5924-4a35-a356-f916fa9cbbae", "sighting_of_ref": "indicator--61a6416f-6122-4147-8086-e0c3a83ca29b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b082b4-ff32-4f56-8450-f901cde10d50", "sighting_of_ref": "indicator--4171c310-ba4e-4d4e-8d7e-efdf20526bb2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82776aa4-c9bc-4825-9bbe-8662c3e497ba", "sighting_of_ref": "indicator--d083f7ab-ddb5-444a-b6b7-57fef18efb6d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca87aced-12d6-4f95-9217-714eb73acbb3", "sighting_of_ref": "indicator--c5be5cc6-3933-4200-8156-7555e98d1f37", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538ca1f4-4e4d-4d09-9ecb-94272e6494f8", "sighting_of_ref": "indicator--cba45feb-5e8d-4ad5-a31d-185d43cca08a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58957c79-9806-4e84-8395-962a0c82275d", "sighting_of_ref": "indicator--dd5baa83-e0e5-4b47-a3c6-982b43b47528", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--365d8d93-4144-4687-9fa4-503dccce6c25", "sighting_of_ref": "indicator--d35d2ce1-db0d-490a-b31b-14c13af57b83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61dc58ea-0f5c-44f4-b866-21e08996b254", "sighting_of_ref": "indicator--df40403b-1558-46bf-bde5-fafc4da68358", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4144725c-bc5a-498d-924d-16244056d310", "sighting_of_ref": "indicator--cffc5069-105a-4cb5-af82-95a6a7952343", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b18b0d11-58fd-41c8-94c0-e61826f931b5", "sighting_of_ref": "indicator--626b70cc-e531-48b5-852e-f26bb5b5e22d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96e712c3-1056-4f67-bfc5-45387c2b7962", "sighting_of_ref": "indicator--a545c9cc-489d-40b2-b239-2f6dc9c45518", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b1cfc4-b4af-47ea-8901-294e18e74ab1", "sighting_of_ref": "indicator--c5a626a6-e4b4-4668-9bc9-5b1b82b5e166", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c3089a6-d3d8-4adc-8046-704ddc4971da", "sighting_of_ref": "indicator--af7929ab-92df-4d46-a9ff-050f4e55fbea", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53fe600e-464a-444e-99c9-4c75595721e9", "sighting_of_ref": "indicator--e95f7a0f-a7a8-4fdd-bdd2-e7b0bff7b3ed", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f40b56-8ed8-4a77-9805-2b7d5f848460", "sighting_of_ref": "indicator--ef0fe9c2-ba22-438b-9d0d-3e5b1142160e", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abd49921-72dc-4066-a3e2-c864881f7893", "sighting_of_ref": "indicator--f76fb197-2710-4713-b8bb-93b8f7c80aa6", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e02571d-6ab4-4948-a2a8-4d4222d0acd5", "sighting_of_ref": "indicator--a714cd81-d593-4aa3-a8e3-9ac5583e50dc", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a5e10a-afb5-4631-8a36-6a6fc29b1474", "sighting_of_ref": "indicator--87cfc69f-623d-44ef-8cff-1e1ec6593b6c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7202319-308e-442f-af5f-8b3b20523fb1", "sighting_of_ref": "indicator--08d324d9-b00b-4613-9c9d-4d9cc1c87c21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679e3578-4d19-4186-ba64-7c4ce70bdab1", "sighting_of_ref": "indicator--ce7e514a-5cdd-435d-afef-00a2e3053c3d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cef5c5f-97a7-4075-8e0e-7bbb25f862cc", "sighting_of_ref": "indicator--21dfc13a-3176-4c18-8a35-e436d917315f", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efc9f0a2-c3b0-45a6-bc16-aacf57cf846b", "sighting_of_ref": "indicator--0c4c1092-916b-41f6-b6b4-fed3f3dbb8c8", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63162a2d-cff6-4d62-aea4-cdd7834a71f8", "sighting_of_ref": "indicator--57863da2-ee9a-48ff-9072-7ffadc515d25", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91c135be-dc8f-455b-ba25-4673286b758a", "sighting_of_ref": "indicator--05f6be56-d855-481b-943b-13172868f0dd", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d3102a-071e-43e3-9c2a-70e5f9aac809", "sighting_of_ref": "indicator--85c2e5e0-7908-4b15-82dc-736d25aecf7d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b378be-f5d4-470a-9650-d64db1c56352", "sighting_of_ref": "indicator--7586f427-78cd-4234-a220-8e9553e1c830", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23b933b9-1239-44d3-9ed0-735b08928fa8", "sighting_of_ref": "indicator--dc29bd98-01fd-4554-8e87-9bad06d5d3a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca292aa-04e5-430e-9115-3425a556ab25", "sighting_of_ref": "indicator--90487730-0d6e-457f-b763-5eb5c7c50ea4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a26d6de-6029-4efb-acf5-c4c6baffc49a", "sighting_of_ref": "indicator--0da489ec-9a0f-4343-8552-2425568f2f5f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d86834dc-09c3-4f4b-a6bf-4f0201265246", "sighting_of_ref": "indicator--ff3fa6d4-c1c4-4efa-b574-50acf09b2c0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84895242-6f01-405c-8a32-8e8836b5a8a3", "sighting_of_ref": "indicator--9dd84300-bac9-4235-b48e-3df14a2b752d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f0bd1ec-fac6-4de4-9d18-98c8f2cf1e8f", "sighting_of_ref": "indicator--3149f54c-4c6e-41b1-828a-05039a0dccc1", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3620f4f-13b9-4372-8e4e-880fc19b9032", "sighting_of_ref": "indicator--aa408a2c-36f7-42bb-ad32-d3342318e09b", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cec5700e-6e9c-424e-84c1-8c73623e4c1c", "sighting_of_ref": "indicator--5765d7ad-abd9-47ea-9cf9-5c7b1dc8c211", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e944367c-8afa-4cba-a61a-50f729797dcb", "sighting_of_ref": "indicator--0320727e-b7c5-455f-b14c-73f384496aee", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14c6c210-b407-41c7-85b0-11024307c796", "sighting_of_ref": "indicator--0320727e-b7c5-455f-b14c-73f384496aee", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d17777-8f57-4829-b403-b9189f3ab303", "sighting_of_ref": "indicator--12d730c2-3143-4b89-a24f-8d2afcaf8d4c", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--113a39d7-66f7-46a6-99a1-229c0f0c27e1", "sighting_of_ref": "indicator--d5055b64-d3ad-4112-aa8b-9e4b9e252a0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2228f76-25cb-4a00-bb9c-64e2cf030ff4", "sighting_of_ref": "indicator--8b13b80c-81a5-4023-b56d-f994b5609989", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c588fae3-ea6f-41c8-a077-48f79bd06f58", "sighting_of_ref": "indicator--768e3a95-05cb-4b13-8945-b2f5c7b7e26c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9d6cfc-cc96-4de4-8eea-69b639259857", "sighting_of_ref": "indicator--28457579-b712-42d7-9ca6-13f9b892cb0c", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb665a7-794a-415c-8d3b-715b01bc3359", "sighting_of_ref": "indicator--71f27194-99b0-416f-bb75-9dd50042be52", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--111ca43a-c7fa-4b41-b054-72f768949c8a", "sighting_of_ref": "indicator--e166e2b3-5ba1-4a75-a825-8d8e67be2dea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146b334a-c6d0-403e-a981-3613496a0e6f", "sighting_of_ref": "indicator--acd4dee0-53dc-43e5-8740-705060e66ce1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cada471e-3964-4ec5-8904-3494275425d9", "sighting_of_ref": "indicator--c27cb55f-6f25-4f16-8bce-bec5a55e4958", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4609566e-f91f-4df8-9136-436fc75ed4c6", "sighting_of_ref": "indicator--e932b933-b9b2-4aa4-812b-8642979e3854", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4049fca3-1ab2-4f97-8e1c-7ce7cb19acdb", "sighting_of_ref": "indicator--dee130d3-48f1-450a-a477-aafcbe50be2d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0eba0e-819b-4431-b361-0f9583eda48a", "sighting_of_ref": "indicator--a913b7c4-0c34-4c14-a86b-7790d0e15f56", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c6ee9a-7209-47ea-9d3c-47fc9f3137e1", "sighting_of_ref": "indicator--4e445dab-f547-46d7-b3f6-4f6a93702ddd", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293cb42a-201e-4914-afcf-e70251fa655a", "sighting_of_ref": "indicator--088a03aa-a9b3-443c-8920-a95615be6506", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea052a0-5a58-4e03-ab52-eace9b4d91fc", "sighting_of_ref": "indicator--4239260a-bb41-46c3-bbfc-b2c160e726e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3be0ec00-3639-4d22-8267-264517af161a", "sighting_of_ref": "indicator--6f8ae848-ddaa-4681-bebc-420b5e95e698", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe5c2c3a-f878-477b-b453-515f826dcdef", "sighting_of_ref": "indicator--9fd34725-6b85-4522-9465-c153156eb39a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bfc8e96-1608-4caa-bfa2-653132db1229", "sighting_of_ref": "indicator--5b9abe7a-3690-41fe-ad38-5d1553c9edb4", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--114950bc-e703-4ba8-bba8-f8eb449e55bc", "sighting_of_ref": "indicator--037042dc-d32b-4417-ae11-20c5ce963faf", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517c5e19-b251-44be-8580-581b2423ae89", "sighting_of_ref": "indicator--b6c0c839-f757-4072-bbbf-4e31babc63a6", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0796dd4c-258d-4f3c-a67a-fcdf30998cb9", "sighting_of_ref": "indicator--85338d16-c011-4dbc-ad51-7829350fb35e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e32442-a142-4f3e-b9e0-0f4c02bc202f", "sighting_of_ref": "indicator--1e3d5919-07c7-40ae-a3aa-6fa72d411bd0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f26f4da-914a-4fd2-a82a-9bc3c36a154c", "sighting_of_ref": "indicator--bdc700b0-bfe5-448e-8f0d-c67d79e6fc01", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06454754-176b-4de4-a2db-12b140c631a5", "sighting_of_ref": "indicator--dac0d3da-a697-4caa-bb06-b54945bcd2f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e78a925-14ad-4ccb-a198-d1fbbceb1672", "sighting_of_ref": "indicator--d9204abe-214a-4adc-8be2-05003d0b1449", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f591c9-c78f-4f54-a061-2c9ff538201b", "sighting_of_ref": "indicator--435cbf36-5930-48bf-bfcd-2215d3f384dd", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66eefd6-c3da-47aa-93ce-4a2bf159ff41", "sighting_of_ref": "indicator--cb971eb5-a8f9-4b1c-96fa-4e5b13698828", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77325ec4-1499-472d-9470-9510b142095c", "sighting_of_ref": "indicator--4ba180d2-b971-4789-aeb9-37a7f665e06d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--144591de-979e-4128-836d-4a55066d3d56", "sighting_of_ref": "indicator--f0cc8f4f-b190-4812-ab70-3d77b586dfe9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5968abda-c7c9-4c0a-bfec-89973876dcdc", "sighting_of_ref": "indicator--9c95fb2c-5c79-41e9-b0b5-aeea63a600c7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33208c1e-0020-4e81-a954-f9bf3033c5b5", "sighting_of_ref": "indicator--f5489751-4458-4612-adb2-2116d49e439f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eb323e2-4028-4962-974e-dfb14114c717", "sighting_of_ref": "indicator--67054db1-588c-4c90-bb90-7c32e4404fb0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66fbd402-0328-4061-bc43-2dc1478f63df", "sighting_of_ref": "indicator--15e7badb-0207-48d7-83a8-00791e1463cd", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44836917-4113-4b3e-b8f6-2b07cbab8a50", "sighting_of_ref": "indicator--f530e278-016c-41c5-a36b-70f61860a478", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46f2ed00-035f-4564-96e1-ca5d82533879", "sighting_of_ref": "indicator--81b2b08f-3f8d-4aa2-a9de-7f01400f1d1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e27d8de-e2ce-41dd-ad67-ee75fe036f65", "sighting_of_ref": "indicator--70ca799c-04c2-419c-8869-cb29e3632ba8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7720ba8-6acd-43e7-8806-2406179e5063", "sighting_of_ref": "indicator--4ca939e4-89ad-4f2f-b2b9-7fa54b8da350", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed7bd80d-36e3-4268-855c-48c9f9bf07e8", "sighting_of_ref": "indicator--6a558943-aec0-4270-8d41-3da8097260bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--637dd52f-214b-4ad2-8705-1d0fbe0ad273", "sighting_of_ref": "indicator--ffe33437-e5f1-4c34-8a98-7348960f5d17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00664ac6-c828-4bb1-84a9-c8dbe17c4954", "sighting_of_ref": "indicator--0e22d683-f940-4fea-9e3d-d7238ccc1165", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1565f34-5bcd-49ad-853f-b4077037a4bd", "sighting_of_ref": "indicator--dda5d525-a9a4-4c1b-b875-df8a64886b48", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afa5e16-17d1-4a57-92b7-95e31da1d98c", "sighting_of_ref": "indicator--9e9cd7e9-1b9f-4d8a-afdd-9fb43f20c74a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be40f894-3881-494f-8f38-b9cf9441eb6d", "sighting_of_ref": "indicator--aaa90969-e849-4062-b4f8-d3a2062d7b3b", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca9bc52-63a6-4aeb-9101-5994b9861e6e", "sighting_of_ref": "indicator--6d0a9582-647b-4f0b-873b-5816ff14ab90", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69f8953c-672a-4fea-bb77-4b4e591d63e2", "sighting_of_ref": "indicator--7121743c-ae52-402b-a254-de1357b1976d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--785a890f-b6b6-4e8b-b3c9-f3db68f14559", "sighting_of_ref": "indicator--991c9561-64d0-4dd0-9d22-06ea682eba12", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e834bc1-c278-402f-b460-3bc50d7c7ecc", "sighting_of_ref": "indicator--8bfadf2e-7a70-4396-ad48-568a51934632", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef53baa4-5feb-4fda-a398-ef77e844ad72", "sighting_of_ref": "indicator--51194a47-870f-4cc4-98f1-6129c59e5f5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c2ac0d3-cf67-4283-b42a-4511ab18fba9", "sighting_of_ref": "indicator--7b648e72-c5a2-41b1-a626-e3ae41409a37", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02295c0d-b5e1-43c2-b218-0a1f8698ad7a", "sighting_of_ref": "indicator--160fe854-ef4d-4e4b-bb57-7ba3ae210db0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd1ca2a-0124-49ae-9e0d-8c4dd1a35fb4", "sighting_of_ref": "indicator--a19ef107-725b-442f-8d2e-339476f693cc", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--695c160b-3b75-4675-a548-2d4b33d29c1f", "sighting_of_ref": "indicator--6619a21d-be2f-4889-a635-3961a89eab61", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fdd0851-bfc9-40c7-b904-d36ee8fb9695", "sighting_of_ref": "indicator--b8d3a40f-1be0-4d9e-ba2f-919cd9bbc315", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46fd9cdb-30b4-49d5-ad09-0aa35df2584f", "sighting_of_ref": "indicator--18f815d6-24d1-440f-942a-6b5f93401a90", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e69577e0-1c15-454a-8f22-ee6aac18ac52", "sighting_of_ref": "indicator--7d6f5185-14cf-4549-b149-5a6519988667", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a579bef-f0e5-481d-a6dc-8681fd0b3ad0", "sighting_of_ref": "indicator--fe0a11ca-f414-4db1-bd31-e64b4b1eceb2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7c209c0-a23d-4566-8cdf-c40d309a236a", "sighting_of_ref": "indicator--638e18c0-ee1c-4648-a722-08b673ae20da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cdd09d-fa2d-43bd-a68b-33e36490d022", "sighting_of_ref": "indicator--248e2b31-428f-4804-9dfd-4d565b4f7a14", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--401a6aa9-88b8-41c3-af9d-6211af4fcf1f", "sighting_of_ref": "indicator--d0bf6a60-52a5-4a63-aa5d-a7ab134d7645", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53bcf8ab-9c1e-4534-974c-1f8e580a3366", "sighting_of_ref": "indicator--46fc28fb-c75c-4c43-8ea4-42de96e4bd57", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80e4407f-cfdb-4b23-b850-fb1ed5cca842", "sighting_of_ref": "indicator--8b07ec2b-7462-48fa-9e5a-0689d402f204", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0adb5020-1cbc-4cf4-9a85-bdc1318e8ae4", "sighting_of_ref": "indicator--2255feaf-04d3-4718-a182-e55c1af5836a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7b8b01-5e4a-477e-8695-346c86c8eba3", "sighting_of_ref": "indicator--38f3562d-baed-4a22-9358-0174c5ce0359", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab06408b-6f77-41f0-8127-c13aa41adf3a", "sighting_of_ref": "indicator--38548828-c55d-422e-bf5f-0c6ed93bfacc", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--442683e3-dc38-4aab-a829-1f7a10236a4c", "sighting_of_ref": "indicator--359eb519-72cd-4f8f-a1e5-547a2cedf3f3", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4b1d802-dc30-40d6-a627-f09468affef2", "sighting_of_ref": "indicator--befbece9-1fa8-422c-8122-9dd701ebd9e5", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528363f1-cae2-4c46-aef0-0a6157c18f33", "sighting_of_ref": "indicator--6abceb3f-7cac-4660-8e89-7308b7322f9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c518cc-d5a0-4fdf-b0e3-fae10807b71f", "sighting_of_ref": "indicator--9e014b49-a66d-408b-8c18-e76fd47884e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3668d99c-8a7b-4d7c-b20f-30b66a5e6fa0", "sighting_of_ref": "indicator--faecbe12-ffdd-425c-9885-eaab57f4370c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d26b021-e45f-4be3-9c8e-683c9ac77cca", "sighting_of_ref": "indicator--c506cca1-e376-4f49-8833-e6b7ad8e17ed", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--415d8506-d201-43df-9ddc-ed528a27f21e", "sighting_of_ref": "indicator--4c95c8e9-5a98-45c0-bf58-e1d14fe3ce7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5224ebdf-93c4-4bdd-bc9a-1a53c6e476ff", "sighting_of_ref": "indicator--c08a7bdf-97c9-429e-b17c-7705b6aec8e7", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c983e68b-fe35-44c8-bc1a-bb18a06b783a", "sighting_of_ref": "indicator--937acbc9-d0b8-41ff-adde-75f70bdcc1ab", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba200fc9-c470-49d1-9d40-bf2c6b3af8f0", "sighting_of_ref": "indicator--63e780fd-67a9-49a2-8246-6edaf7a77df2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9739cec2-2962-4a36-ae69-475917a9660e", "sighting_of_ref": "indicator--83b947b7-297f-4f99-bc73-d28d4b494283", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3195ba74-9d09-4bd5-9dcc-3e3cfc62b252", "sighting_of_ref": "indicator--58115340-7153-4a00-a0ea-75ae9e005a90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e27388d-ae86-4524-bb1d-4ce59c37886f", "sighting_of_ref": "indicator--e5fd3c05-a50d-45c1-b49c-cac5eb820c8a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f63bd82-f637-4d5c-b2f2-895a2602fc14", "sighting_of_ref": "indicator--0ced7de4-40b3-456b-ba07-f29169292147", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8eca0ab-900b-4ffa-85a7-20408ece3bd8", "sighting_of_ref": "indicator--31590592-4655-4bb6-819b-df5a5431e299", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e8e2c12-1e38-42d9-b91d-a81f332e9e6b", "sighting_of_ref": "indicator--4bcdc611-a5e7-446c-8555-64a522123389", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--584f01f7-25fa-4912-b903-68399108ef68", "sighting_of_ref": "indicator--36bfc9e7-3ad2-4aef-a2f3-732df8441d37", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1158ef-b678-464e-8c43-05dd36af1675", "sighting_of_ref": "indicator--2498919b-ab4e-45c4-97a8-38e62fd8a867", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e6246ae-787c-4761-8ddc-2939d629dc2a", "sighting_of_ref": "indicator--ea3de3a7-ef06-4398-8593-0786d46cc819", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1174553b-d553-4b9f-87a9-fd760d0a9c65", "sighting_of_ref": "indicator--36d60857-1a45-4b2f-bc5a-9a56b52ec5e0", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7e22a7-2778-4a2f-a56c-3ca8d21ca727", "sighting_of_ref": "indicator--1aa4a7f5-8e22-452d-9e3f-dab532a4513d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57dd3048-c556-4f3c-911e-f02442400fe0", "sighting_of_ref": "indicator--4a082e88-93e4-4ed8-8b79-3312e3864f4a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac7eb5eb-1924-4269-a64c-72dd9b635b96", "sighting_of_ref": "indicator--bbaee239-96cc-4bac-a4a5-d7cb08cdf862", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f47e79c-4598-4c30-8e44-522d84c1de73", "sighting_of_ref": "indicator--f93c98f3-5669-44d5-939b-7a2f288f5a78", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1159da8d-9e10-421a-8846-96275bf7906d", "sighting_of_ref": "indicator--ba4c1e9c-1ec3-4b54-be0f-49182d4514a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f77c6c88-06ff-46be-bfde-a9d795fbe36a", "sighting_of_ref": "indicator--be2ee3a0-21cb-4962-a94a-6b28a358fde4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a91a739-1c19-4d03-a15f-0b20344bbadb", "sighting_of_ref": "indicator--6675bef3-b76f-41c8-8f52-52d3ebb6d2a9", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a79e6a-d2ab-4630-88ac-b33643da5c8c", "sighting_of_ref": "indicator--f73d0e9b-21a1-43b1-ba0e-271be2af2e39", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba9d176-0ceb-4c55-bc06-6e4fcb65b437", "sighting_of_ref": "indicator--4cc29e7d-b7d5-4561-9d1a-c85284a5b4d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d61f3f-91f7-437b-9c48-384ee2084087", "sighting_of_ref": "indicator--e8385e48-6136-410c-b46e-74fd915be934", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b808a0a-be5b-4548-ba28-c21cd432f8e2", "sighting_of_ref": "indicator--405a3fdb-da19-49c8-96b8-b72f19b7bc2f", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbdc6f78-9b14-4f15-a548-45ebd69ac1cf", "sighting_of_ref": "indicator--4134b78c-8cfc-4902-a65e-d12fea723da2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a2823e-0090-4652-8772-c3c78a1574f7", "sighting_of_ref": "indicator--d5d3d356-6f56-4a71-970c-d79cfb63d012", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6849744b-1dad-4fd4-9c22-88be5bf9101f", "sighting_of_ref": "indicator--f5ac7442-636d-457f-8829-9bc2d8931738", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--151368aa-38c1-40da-ad00-6681d5701b82", "sighting_of_ref": "indicator--2e30dceb-0ec7-4bce-9917-15a06c1b4afc", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20d8e770-2bb8-4de9-b045-49d95a35b0b2", "sighting_of_ref": "indicator--363d9e33-e558-4b06-a198-867e31ebb2b0", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b03d4e4-9b5c-4058-a05e-8bf999fc7df2", "sighting_of_ref": "indicator--424aced8-fff3-42ea-a784-296f7475bbcb", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0351a5c1-0170-482e-ac6a-69dabc592fdb", "sighting_of_ref": "indicator--90c900cb-0bb7-44a0-a755-b5e555e5a9b4", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19f79d2-f00a-4064-93b9-98cc0f4a73f8", "sighting_of_ref": "indicator--364a3ef7-8658-46e2-9049-b23b71222b79", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--371de49a-e613-4fd0-8a9a-90230627a56f", "sighting_of_ref": "indicator--364a3ef7-8658-46e2-9049-b23b71222b79", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c24caa48-67bb-493b-a05f-d11098f4078e", "sighting_of_ref": "indicator--d1f8b958-8219-47ec-a9ed-a5c57fa6d77d", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a98d9c-48be-476b-8b1f-4bbd7227ff4e", "sighting_of_ref": "indicator--19ac8795-b6b8-45c3-a4cb-3c76b18b7bd6", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34651ae6-7336-4cdb-b404-f180a81e52dd", "sighting_of_ref": "indicator--108ca67c-8223-487d-8410-1b35932fb781", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17bd0cd8-564c-4ae9-b98d-6dcbab8be2c8", "sighting_of_ref": "indicator--40608dcf-79d8-40a0-a8b8-b2908e17adca", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5416348d-79c3-4c0d-82fe-3fdd0641b892", "sighting_of_ref": "indicator--1b616778-2726-468f-a2cf-247c5501453d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ad003fd-7b13-44ca-ad98-9334fc68d9a2", "sighting_of_ref": "indicator--c9e263d4-6fc8-40bd-8ebd-be8a6ccef5f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8df68ee2-8ff3-4493-a1eb-20e9023fc57f", "sighting_of_ref": "indicator--bf5b9f91-d952-4b60-aa5d-b391594e055a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0dc3bc-6af0-4ac1-95b8-1970c5278acf", "sighting_of_ref": "indicator--cef746fb-753b-43a5-b615-0c3789a9e28e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6159ef7d-7957-4054-b4c1-caea8587b47f", "sighting_of_ref": "indicator--193ebe8a-f75a-4589-a9fa-bd63238935dc", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45964bca-2731-4cb9-b6f0-17aa76d372f8", "sighting_of_ref": "indicator--eeb2539f-1227-45a1-b849-4e5bb4191fac", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd5b7c63-b58d-4a8d-b1de-69972fe72c66", "sighting_of_ref": "indicator--9711f71b-c480-49f9-a21d-d303591ec41d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e5c83c5-1357-40f7-a3f8-e59b35635692", "sighting_of_ref": "indicator--e59be5c0-736a-498b-862e-b7350a601df5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0381a28-0e40-4507-b5f2-0fa030f3ffae", "sighting_of_ref": "indicator--8484ea66-3a91-4a1f-92f8-83e1698f157b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2543a41d-ecf4-4ecd-830f-f8db297c352c", "sighting_of_ref": "indicator--c105c2ee-63bd-4949-aec9-fd486a6984a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8608e9e6-e026-4aef-ab54-8f8918af3476", "sighting_of_ref": "indicator--84fde415-3b31-4e4c-9fe1-c1808447c3f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c058874-e5df-4531-ac82-1f1bf29292d2", "sighting_of_ref": "indicator--734be533-8b08-4fbc-81ec-d64490afd6ce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3821a715-7345-4081-b1b7-195861295180", "sighting_of_ref": "indicator--2a8a86f7-951f-4bd2-8d3e-b4cb35dffd50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeffea43-e37a-4938-a18d-d4ea63f08d80", "sighting_of_ref": "indicator--7349321f-5076-437e-8299-e7304a165e5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--547f87d6-dd22-45aa-8967-8895e08e7431", "sighting_of_ref": "indicator--6ce2f7dc-2253-4748-b451-461171c74bbc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f86ed55-f76c-476a-af6c-96b0175ea855", "sighting_of_ref": "indicator--d63aefb0-b9af-4b86-aeb8-2e7904b2d048", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c869e72-a06c-4738-868c-33c6cef771f0", "sighting_of_ref": "indicator--bb3aff59-bd80-405b-ac85-d9cca1935bc2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34327522-ac2c-4eaf-bff2-fbdad4d29314", "sighting_of_ref": "indicator--2a61186e-6dbd-4959-98b2-393505aacbf1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e769421e-0c61-469c-9b99-ea0014c0b353", "sighting_of_ref": "indicator--d8699f46-5d00-4e38-9e37-005843504999", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ede6040-3ef3-4d59-a391-0ffb144281bf", "sighting_of_ref": "indicator--668ce408-3f31-4b51-9f33-90a350c3ab95", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ba19858-573e-4bef-a4a6-f5d000cc5d4e", "sighting_of_ref": "indicator--701cc2d8-46e9-4492-8195-c0777c481637", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19f1ff1f-6519-4751-ac87-7650f50a1d56", "sighting_of_ref": "indicator--8239b483-0b5e-43f6-a4d3-51127760834f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--895cff2e-1c30-461b-83ee-bc1447a0482c", "sighting_of_ref": "indicator--004eddbb-cadb-4540-9c24-37f307bfc00a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b7ef943-98be-44be-b0aa-401ccfea2768", "sighting_of_ref": "indicator--49e4d686-a8fa-4a55-9479-b90c997c2ec8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0936daea-a686-40fb-beb8-7e83c0880a70", "sighting_of_ref": "indicator--561fbb22-6822-4458-998f-aff48b30f09b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--febcc5c1-528c-463a-85fc-d10c55f052ba", "sighting_of_ref": "indicator--1d84fe07-9452-414f-bce1-f9eb621ec7ab", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17169c3f-36a3-4028-896e-5194073e375e", "sighting_of_ref": "indicator--9cd81d15-d53b-492e-8263-908796597b8e", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f860a3-509a-41be-a19c-b448f7b2f2a4", "sighting_of_ref": "indicator--a47d7b83-09aa-4b44-8354-360df039f893", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0eb4ace-d2e1-4bd5-8469-e93043a15581", "sighting_of_ref": "indicator--a23c24d9-c7bb-41b6-b7b1-0447f8200408", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4aa495c-077b-4d83-8c71-316bd4f4893d", "sighting_of_ref": "indicator--bc17b749-b476-42ff-9227-da70bba62cf6", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0273b7-4c22-4bbd-84e6-20083a09c0db", "sighting_of_ref": "indicator--b2bf94a4-e0a1-49d8-82e2-bf59fa5e67b4", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f47871-90cf-45fe-9763-de874be87dad", "sighting_of_ref": "indicator--6a55432f-fd41-4f1e-b70f-56d690088c70", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e526bfd-c49e-46b1-9449-04d5cfafc249", "sighting_of_ref": "indicator--f3c766ce-6598-4b48-93ae-44c93863eca2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6d6519-d4f6-4a11-a121-1804af6867df", "sighting_of_ref": "indicator--ca451171-9405-420b-994f-8270f494b6a3", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4bc6153-d3e4-4865-a88e-92fc19991ac8", "sighting_of_ref": "indicator--39c9cf3e-824b-4adb-bc30-f5523637109e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8686e88-1b70-406f-894e-dfca08d37d6f", "sighting_of_ref": "indicator--7453a716-7849-4ee1-9e50-56aa9d3de450", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe813863-1eac-4fd7-8204-38c371b9d814", "sighting_of_ref": "indicator--621bee9e-0ce2-4cb3-bbc0-eecfb4320d4a", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab15f739-39d1-4f87-b335-552e9b106c26", "sighting_of_ref": "indicator--2e5d4134-8b32-49df-8683-ac4a64c44b6f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a312e8d-9419-411c-bd27-4fd823919baa", "sighting_of_ref": "indicator--0dc61a80-cd52-4a2d-8cf5-a3734677344c", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d5ced5-d578-49f5-a7d3-e4f2292673fc", "sighting_of_ref": "indicator--7144dd3a-9edd-4994-b324-58ad7f940f40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6942df6-a51c-49cf-9adc-0beb362a9c7f", "sighting_of_ref": "indicator--4585a5a6-e124-4bea-a10a-e61ee39da716", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b27cb7a1-186a-4629-9c55-e85a5226b956", "sighting_of_ref": "indicator--bb3abfee-4871-4216-8dee-69cd31a39b1d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2584390a-21d8-4447-b449-a90bedf8389b", "sighting_of_ref": "indicator--f794664a-27bb-43f5-b8d2-e351b994e3d4", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acde9e24-43e1-4c3b-b5c2-5ccc39ef2b9d", "sighting_of_ref": "indicator--8ed8f485-ff88-4f2e-8cbe-cafc4bcbcbb5", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--886c2827-a938-4413-8a19-40d0dec4237d", "sighting_of_ref": "indicator--b87f7381-c171-4dd7-928e-7ef11c0646a5", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2fa17ff-d09e-4025-a855-dd48293adeef", "sighting_of_ref": "indicator--ad3755fb-1476-4916-a7e6-5038e2253cca", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edf79ac2-bd51-47f8-84f0-0179e0c9e3d0", "sighting_of_ref": "indicator--06f3ab76-9eae-4da6-ad7e-33fb6ba44b40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93934999-76a5-4993-8284-47ee40546ca0", "sighting_of_ref": "indicator--e2bfe14e-7dbd-4081-b1df-653a0e18cd3a", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--162471b7-a22b-4441-9c47-d8615b9d3239", "sighting_of_ref": "indicator--0daede3e-973b-404e-8825-401f87753a15", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94168ef5-5f0e-4e03-9cd1-7c5e56a0a4f4", "sighting_of_ref": "indicator--c0add56f-63dd-4176-992e-922a3e25a641", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ad48acf-95c4-490f-8476-8291d96937d2", "sighting_of_ref": "indicator--dabb45ea-4bd8-4da4-86df-15cc63cf480d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfcfb091-a818-4504-b5ca-713b3154fe27", "sighting_of_ref": "indicator--1bbc3e98-cd23-4aeb-98fb-a1bd70e12bc4", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c1f891-f8d9-4d1a-a76c-315c1ddfc7d7", "sighting_of_ref": "indicator--4c29985d-f5c7-4f5c-bf08-657ed60a37e9", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20f6254-0bb8-413d-954d-8e5dd315741f", "sighting_of_ref": "indicator--c6625cbf-01cd-49ec-9710-a5c1498da10c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3761aa27-8045-4808-9807-2f336fdfe4e0", "sighting_of_ref": "indicator--79067779-a6d5-4899-a8a5-1cd618b11c9f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52269ba3-c81e-42ce-a1b6-83d182133cfc", "sighting_of_ref": "indicator--62a8934d-1107-4982-90d6-532a5d376974", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182458e3-49bf-472f-ad16-4ba1cb217bdc", "sighting_of_ref": "indicator--0c2db9e5-7978-42fe-a84b-b16f325b6084", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--296e89bd-22d6-45c3-9a56-923dde38fd8e", "sighting_of_ref": "indicator--0c2db9e5-7978-42fe-a84b-b16f325b6084", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a34fed5-70b0-412b-b9b2-2466530767cf", "sighting_of_ref": "indicator--05a250ca-9b02-4337-994b-fc88cc3ea0c8", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e377dcd-9663-4d25-9b1f-45f83f0203f3", "sighting_of_ref": "indicator--5e520fb4-3b74-4603-a5a0-057a410b5515", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b96395fe-4f2d-4ee0-91ef-4d11e4973d16", "sighting_of_ref": "indicator--6ea11955-5351-4455-a15d-79c4dfab6802", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb379b66-3507-4854-b8a6-3cfb87de6aae", "sighting_of_ref": "indicator--fd3bd8b8-7062-46c1-b61d-0820b69111c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eaf2170-cabb-4407-b041-4b6c5cc01f27", "sighting_of_ref": "indicator--de877be8-4875-44ff-81e2-db5ca87a0769", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e02b068-c795-4e92-bdae-d9c15e99bbd9", "sighting_of_ref": "indicator--379ed1c3-7238-45e2-9620-395cfb4bed94", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4698f5-f0d9-40b8-9fa6-4009a2896c29", "sighting_of_ref": "indicator--248bdddb-4f10-4eb4-836d-a1fb48012add", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d7a4846-8aae-47dd-8ae2-1b505e186106", "sighting_of_ref": "indicator--1151ae9c-d991-4d45-9f50-7fb5eecc5157", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c854fcc0-2826-4068-ac52-50c84143eb4f", "sighting_of_ref": "indicator--f0fc1a27-eca9-4f02-a565-da6f33eb58e2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045e386a-3117-489c-b8b3-8cf2b588eeb0", "sighting_of_ref": "indicator--2edd4668-8d89-4952-8215-05a49e03153c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d72d9b5-25c4-45c5-b15d-bedde77756f6", "sighting_of_ref": "indicator--b7d5e1d4-acb0-48dd-8ff6-cada346cc81b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11f3f42d-ffcb-4589-9649-95c6405c4e37", "sighting_of_ref": "indicator--3119782d-7dd7-4bfe-b0cd-1c095eb46d89", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c4aa7d7-0a1b-4a6a-8e93-f3fbd438b01c", "sighting_of_ref": "indicator--c5206e61-783e-4cf8-85e7-134b7175c90a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44bfada0-d42c-4fe3-834c-1c04405485fd", "sighting_of_ref": "indicator--63856ff8-6891-4409-9719-7ff21de12990", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e875f0-9a91-4b21-8ff2-dec01ba7bf2e", "sighting_of_ref": "indicator--5f48158e-32fd-460e-b353-5534d748f421", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc9fca12-9948-47a2-b92c-15e6a1a340c2", "sighting_of_ref": "indicator--6d8db146-135d-42a9-b3c9-7837f465e497", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f043636-3e73-4cb0-9203-13566a9949ed", "sighting_of_ref": "indicator--7b144f71-b958-497b-b9b9-4f0fdcec9592", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05ad03b3-5b57-446e-b8b3-b2efce06b7f6", "sighting_of_ref": "indicator--6dbd50d6-c060-4598-bcce-4081983d9dc5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e620094-1d4e-406b-b0d8-5320c4a45954", "sighting_of_ref": "indicator--fbdab16d-7191-4bd3-9705-c328c4581f3e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2680fd69-9a45-4966-8a95-3c334fc98185", "sighting_of_ref": "indicator--6122088f-cd6b-43f9-9ce6-4c814a935fcf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79e0690-cbe6-4259-beba-d0a4b5e37300", "sighting_of_ref": "indicator--a6314e30-a5e5-4f21-9e4c-63c38e1a5099", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad2f397-e778-48b2-a55a-e1721641b3ee", "sighting_of_ref": "indicator--cea3e976-2d2b-46e9-8db5-a52c75a830b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90e160a-5acc-4019-bfc7-05c369d83dc2", "sighting_of_ref": "indicator--84441d84-035b-4cf2-9db7-045e469e200d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe96ddcb-f865-41f9-a69f-8e53ee61da1c", "sighting_of_ref": "indicator--30a70876-c204-4bff-acf0-86f84444b7be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef148579-60fc-4767-9509-0201d8aa3d95", "sighting_of_ref": "indicator--82f86c85-3515-4214-9450-116310425f0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c3b1d8-7bea-45c3-a814-ccac0bb5f871", "sighting_of_ref": "indicator--ca497608-92e9-4a8a-9309-0b4195482d77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--165afd79-8009-41c4-97a9-8f2485ddb953", "sighting_of_ref": "indicator--376c81ba-7e04-47ca-be45-28c1db5c030c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab8731d-3336-4ab7-ba64-8a5b8f7a828c", "sighting_of_ref": "indicator--8f917cae-8003-4f3d-8320-0326919006f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e95e982-d7aa-4841-aa53-d88734feb922", "sighting_of_ref": "indicator--e67861db-77d6-4394-9329-ff3902f1e523", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2bb8f8b-b908-44f2-b7c9-99b5595876cd", "sighting_of_ref": "indicator--498bb480-bb22-401b-8aa3-0ba5402436d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e113fd2-991f-4ae7-bf9f-ca7666e4a558", "sighting_of_ref": "indicator--d92a29d4-9216-4c7c-9f41-cc5492f0ae11", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02198fb-ad3d-4129-83da-33054181786b", "sighting_of_ref": "indicator--d92a29d4-9216-4c7c-9f41-cc5492f0ae11", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26c2aedf-c125-4844-8f95-5730eabbd82b", "sighting_of_ref": "indicator--361424de-b01a-4709-8c60-422bc6ec80d3", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5b4dc8b-a575-41a4-93be-4338dbd2269b", "sighting_of_ref": "indicator--361424de-b01a-4709-8c60-422bc6ec80d3", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9995815-b5cb-457f-8222-607e5afcfeb2", "sighting_of_ref": "indicator--5346fbbb-8244-4e6e-95fa-f6bc49372bc8", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--103bd4fd-e9ef-43d9-aaab-57beeeb89d19", "sighting_of_ref": "indicator--5346fbbb-8244-4e6e-95fa-f6bc49372bc8", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645ab1c7-5433-41ec-9a03-b54ec7a03f9c", "sighting_of_ref": "indicator--e2e1a20d-4b10-4f24-a59c-ca1b58034f54", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77b2cd45-36d5-4ad8-b1e7-65a8f8ab0050", "sighting_of_ref": "indicator--f7a1c976-ca3a-40cc-8d84-feab7f3bafdc", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44daa319-dc21-4111-861d-cb6faf0ee896", "sighting_of_ref": "indicator--da75402d-6059-403f-b82c-831110076486", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fd0ab9c-ca7d-4dce-ae59-066c52e160e9", "sighting_of_ref": "indicator--60280e95-b1f1-4a5f-b0d2-c5cdad8ae99b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f44f9f-276d-44fd-a820-36e091495deb", "sighting_of_ref": "indicator--8a13f601-08bb-4eb5-a1f4-854643006656", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6862ff-e1da-48ac-85cb-26aa64286b77", "sighting_of_ref": "indicator--8e30265b-d0e1-4774-b571-e871fdd63efb", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26504dc4-461b-4898-9b26-a02703b107cc", "sighting_of_ref": "indicator--1619b851-dd71-4da1-9984-ba685df4c852", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f146bca9-e26d-4de5-b783-c191f0ccd92a", "sighting_of_ref": "indicator--d3c94072-7307-45c5-be6a-e91e327fc7ba", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94f05c55-647f-48c1-a951-84635ab0552b", "sighting_of_ref": "indicator--2ef0b579-9b07-4ca6-9d8e-728385a200b0", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--583188f8-c797-465b-a2eb-89498c8b436c", "sighting_of_ref": "indicator--e8bc6ec3-8af2-4866-8900-168a95d23959", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--714e17df-d16f-44db-9a42-80e61f677558", "sighting_of_ref": "indicator--acc22f26-66e4-4181-9801-309f3713595e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28789c14-275e-4848-8d72-9d10432441cc", "sighting_of_ref": "indicator--d58b29bc-6965-41f7-8505-797f0300dc0c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08546481-77c4-4f01-9e3c-72c2589e5c8c", "sighting_of_ref": "indicator--0d313e38-dbc4-4455-ade2-a6fe0b89dc27", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246b5b1f-de58-4005-be00-1634d7d01a3b", "sighting_of_ref": "indicator--468ff3b2-e62b-4bca-9e54-cd7b1625726a", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc1430c-a13c-4b68-b03f-f38420a096b8", "sighting_of_ref": "indicator--8dc6840b-ae19-4a6c-97ee-b6d06a0b471c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7035db0d-d82e-4d0b-a33d-899ab46b7e6a", "sighting_of_ref": "indicator--f52e900b-6680-41d2-9768-7b430da5b7c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b733ffbf-620a-405e-9bbc-5176b32a36b3", "sighting_of_ref": "indicator--e031290f-3c3b-448e-838d-4379a1d50055", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e648917-1233-4832-8201-0455f72b9591", "sighting_of_ref": "indicator--8e41865c-a5de-43a6-a2a5-f6a4b4e3e800", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28c9f35-3946-4d61-8bf5-9fac8840f96e", "sighting_of_ref": "indicator--67b040e2-914b-4dce-bc02-aa9e971a06f2", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbfa8d35-9271-4846-87d5-95fa1494cfc7", "sighting_of_ref": "indicator--9befccbf-7a37-40e9-be16-956f878a28cb", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5d3cdfe-eec8-4011-bfdc-b3261a2d0e48", "sighting_of_ref": "indicator--bd83bc35-2887-45b0-8836-3706ab799100", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f2d1b2-fa22-4dc1-91f8-0a2aea4c416b", "sighting_of_ref": "indicator--79451dd5-4262-494a-ad83-5ec52faf2f7a", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f08900-5c39-4931-a367-87f35c1c0891", "sighting_of_ref": "indicator--40b1072b-3d31-4235-a716-a3f579ccc5f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59126643-1b4f-41af-9fc7-8bce2caa3650", "sighting_of_ref": "indicator--a1fb177c-595f-4057-b2f6-382d85784f84", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68635c8-ab5d-45c5-8080-01b7cc1e0031", "sighting_of_ref": "indicator--6a4c0d3b-b94a-44b0-81de-cab5ffb0df42", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff815645-d447-484b-a740-896850bdec22", "sighting_of_ref": "indicator--9bfc7a84-65cf-4010-aafb-7c66b172a8dd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d254af8-241a-44a4-acfe-b114b7bb7480", "sighting_of_ref": "indicator--06f00a74-0a38-46e1-98ee-bca46e26e0e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec14c87-909b-4605-88fd-5201057b0fd3", "sighting_of_ref": "indicator--5ab8a7f4-dd66-418c-bcf2-6f1041b9d8ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da4a1ffa-256b-4bb1-9086-1f489a3fcd8d", "sighting_of_ref": "indicator--b9943578-2785-4968-b93f-0eae7a28d205", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ba7c936-dfd8-48e2-9e1f-275947d5b014", "sighting_of_ref": "indicator--b8b20f5d-1b80-4562-90d4-f8a35f01fdab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f08b6180-a657-4b98-8eaf-913fc40571dc", "sighting_of_ref": "indicator--383da508-036f-4413-8e70-358e1528dcbd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60870b24-0f61-4010-9756-8343d8cd66fa", "sighting_of_ref": "indicator--6eb63c89-4817-4f1e-95b2-0d4ea40c99aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b822cf82-7f70-4314-a0a3-fc5185b9837d", "sighting_of_ref": "indicator--43645cd2-26c4-4480-a521-d4e7a70cbf80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f708838-9b82-43cc-af0f-83d6b1db45e4", "sighting_of_ref": "indicator--2325bbbc-2559-4717-a5ce-48f465689e11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fea0d0a8-34e2-4002-9ff3-bd04a491f36a", "sighting_of_ref": "indicator--dc441bdb-4a9d-4ab8-9254-970c5e29c774", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45e45175-2908-4eea-bfea-b2cdd3fff47b", "sighting_of_ref": "indicator--5e26f48f-6b0b-4e29-9e42-ff0119f02c3f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19f59a8-0021-4b9f-bf48-aae67f323d13", "sighting_of_ref": "indicator--d212030d-19d1-43d8-9a39-f271e4b70ecf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--956beff2-179f-4e97-959a-3ccc0ad1d541", "sighting_of_ref": "indicator--52f7c1ad-155f-4742-be10-923c5ff47e43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39587e65-dbf8-436a-a8e8-92e6455f1184", "sighting_of_ref": "indicator--c3b44b54-8851-4217-8944-abee20464258", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b294b146-19dc-47ab-a081-9f4b4245a76c", "sighting_of_ref": "indicator--fd369a26-513d-4674-8452-a6bb228078b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db02b70e-8cf7-47b0-883f-0460c850e523", "sighting_of_ref": "indicator--73a15ef9-45cd-40fd-992f-1278698433de", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5329d97-4cf7-4564-b4f0-0997d7530aaa", "sighting_of_ref": "indicator--1a7d526a-1992-4b14-b7a3-a405b8f6f5ed", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad45b777-ae14-4a9e-8c25-49641b6ddb7d", "sighting_of_ref": "indicator--412f1ddd-90cb-4c1b-8ce0-eb5b7fe070e3", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--181fe337-456b-444d-9ab2-cf35e44052a8", "sighting_of_ref": "indicator--180d0d92-1070-4d6a-bb38-b80e62244904", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77cf9fcf-5026-4981-99c9-8175d7c3f632", "sighting_of_ref": "indicator--0594b9e9-3f66-47ed-ae82-09424536aa4c", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21fee5af-2e2f-44cd-8754-70995c9b2375", "sighting_of_ref": "indicator--d071bc92-2875-4c7f-8da1-4f0ee948855a", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d87a6064-b40b-4f44-896d-fa73d0c91bc3", "sighting_of_ref": "indicator--7b68fa61-5851-492e-aebd-d38f81b19373", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77a20508-411e-4eca-a61f-81a856926c8c", "sighting_of_ref": "indicator--da3b9aae-6e59-41fb-b825-b29517aab2e1", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f06f46-9924-46ef-8ee8-98dcb6bdbcbe", "sighting_of_ref": "indicator--d35f49db-74c7-4826-b6cb-1749d2f2f3c7", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ebb33fd-dd9a-413d-88cb-ccfc88b13ed8", "sighting_of_ref": "indicator--8df438be-0947-4c2d-8375-085d4876a180", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2726b166-1be4-49e2-9452-e19289f4b2e0", "sighting_of_ref": "indicator--088fcff9-5076-4111-b829-388e808fc1a2", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72db1f82-3a2e-4b1c-8a7d-85be2dce8659", "sighting_of_ref": "indicator--51de0aec-0de3-4731-a6a3-e765d96c7852", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9425a11-4fb5-4595-b036-a993612722cd", "sighting_of_ref": "indicator--032edd92-a99d-45de-b989-1bb6891fae0b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ac3a122-f0d7-4482-8670-80840cf4f927", "sighting_of_ref": "indicator--83c383f4-c292-43e8-a910-baa955b3da21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a3578d8-e285-4c26-a1a8-73c8f75a80c5", "sighting_of_ref": "indicator--fde97338-041f-4a10-ba56-d435d73217c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e24f2525-a55a-469b-ae31-f1e5d03e7b86", "sighting_of_ref": "indicator--138ef7a5-e2d2-46b7-94cc-c5fee8005f83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be4e003e-8c46-4d69-a0de-b01d09028022", "sighting_of_ref": "indicator--7daf85d0-d6d8-40ad-b252-e0df6db307d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d39bb76-63a0-40a8-a239-d2e8b3311a74", "sighting_of_ref": "indicator--c6f22aca-f146-4033-84e9-ebc50824372d", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a8d91c7-5725-4785-b2cc-4b918684aba1", "sighting_of_ref": "indicator--caf77a4e-6879-4c9f-89e2-1467ded11087", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be269c15-e57e-48c8-b589-9a79bdfee4a9", "sighting_of_ref": "indicator--e06886a0-4df8-421c-9f78-858cf7ec91e8", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dcc678d-9120-475a-83fc-4cf7da060500", "sighting_of_ref": "indicator--c55b373f-e867-4d75-b684-75dd812999f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5590ca26-9580-4cf1-b901-f38d50742f57", "sighting_of_ref": "indicator--abcb4e5c-c7a2-4105-b372-2e587a49a377", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9e8acff-8af1-477e-981f-f07767368c0e", "sighting_of_ref": "indicator--20faefbe-bfa2-402a-8a0e-4f61f5259214", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11fdc412-1087-4120-8fbd-e631bbf39c90", "sighting_of_ref": "indicator--d721dabb-1227-4916-98cb-65ebc9c74e76", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2603d220-8aeb-422d-852c-0354402f14f8", "sighting_of_ref": "indicator--1b42bbab-4a5a-4fe0-b833-29648af1bc0f", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d57571-4e0d-46cb-a760-5be1d0d2fdb1", "sighting_of_ref": "indicator--dd02ea54-ba3c-4959-a215-da9ba9f752ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5202e6bf-9681-4b62-b7e3-1dc7c0644ce3", "sighting_of_ref": "indicator--3f922b12-dae1-41f8-987f-cf5b5211df6c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac27e00-cc03-4184-ad19-da5809c4693d", "sighting_of_ref": "indicator--cb3f0a93-fd0b-4085-8e69-b44a2b9d5395", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eba9814f-048a-4476-a888-26996b21ac81", "sighting_of_ref": "indicator--6fe793ca-1ae1-42b7-ae3c-a4378c48ead0", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce05c54-a3bc-49db-a182-f2cf7cf21a10", "sighting_of_ref": "indicator--5cf5c209-8967-40a4-a424-1148dd678248", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13c86b7d-faae-4480-9524-7625bc5fc2fc", "sighting_of_ref": "indicator--e76b432f-14d4-4dfd-a4b4-0c3cb96133ee", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be8cf38-0c21-4e39-acad-10e0a62cb963", "sighting_of_ref": "indicator--66c6ff27-889c-4fa9-bced-84617103f6fb", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c10c7e9-cc7d-4a02-8d94-21aa9c9a0383", "sighting_of_ref": "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2baabf4-1854-418f-bf84-f83557eab464", "sighting_of_ref": "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a659817-5537-4624-a50b-993ed293a588", "sighting_of_ref": "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--922046f7-2415-4f71-b1e2-a3f11fe71fe5", "sighting_of_ref": "indicator--343448e7-1d13-4a2f-9f6a-3a21f20d97af", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61885f95-aa0b-473b-81b1-c22da99d7ba2", "sighting_of_ref": "indicator--4a304aa9-fcf1-4a87-b927-8fbded783aea", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6434e901-7ac7-4afe-a650-4695e1bfc2a2", "sighting_of_ref": "indicator--556df774-2197-4290-9fe1-adb6750593a2", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18265a7f-1eb1-4bcf-84cb-fff814514109", "sighting_of_ref": "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8951b00-9e05-4ab6-b70a-83748a4c9a73", "sighting_of_ref": "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c979d678-a9f6-4cbc-bfb0-b8eb5f28b6f9", "sighting_of_ref": "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f85dfd25-730e-4197-822d-a1be5f274a80", "sighting_of_ref": "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59a34b2-acfd-4623-a621-7e7699be86f9", "sighting_of_ref": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd942853-117a-46b2-9072-35f4cf580a27", "sighting_of_ref": "indicator--e67a8cce-2891-4116-8b04-22c766653092", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c3488e-e285-4667-a89d-081ac2d3b403", "sighting_of_ref": "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b2efa2e-c6bb-485d-aef5-b44180b9f764", "sighting_of_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a60278-6646-4006-8ec4-26e3a59ea3be", "sighting_of_ref": "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd2f81b6-b359-4922-937f-e23a1029f796", "sighting_of_ref": "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a17fd8c2-d281-4da7-89f3-632cb6dc7ca2", "sighting_of_ref": "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bbf286a-7f3c-42b4-b2b3-1f4156dd2713", "sighting_of_ref": "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--257f5a78-88e6-4de6-9855-edc747a9fb09", "sighting_of_ref": "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c7a10f-d79c-4585-b4d7-3e02c278ccb3", "sighting_of_ref": "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b240dce3-6179-45e3-a1ac-ca92ec5c9ff1", "sighting_of_ref": "indicator--650adda1-371c-44ee-aec0-6be04367af01", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d9a852-335f-4388-80d5-6c9197b89a7d", "sighting_of_ref": "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2e770ed-7257-4356-98da-1e576a80a03e", "sighting_of_ref": "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d84292e-8483-438a-ad30-72beea52c599", "sighting_of_ref": "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e491f0-3cba-43fb-b93a-53d6183748e6", "sighting_of_ref": "indicator--63331dc1-38cb-4e88-86c1-13f921e8b02a", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb3dc88-fbe9-46a6-b880-1b6017fde7b0", "sighting_of_ref": "indicator--63331dc1-38cb-4e88-86c1-13f921e8b02a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6311f235-0466-4b0b-88fc-22fad1a1130c", "sighting_of_ref": "indicator--73810339-f8c4-4aec-98b5-acd6f28e6bdc", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ab4818-a4ee-478d-a80d-3c39e86be26b", "sighting_of_ref": "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f02249d-60c2-4057-9a38-8d856c4c9578", "sighting_of_ref": "indicator--1e56977d-81a6-4655-b5c3-0b07ca513de6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64885b15-f381-4526-b452-2ec691fe0c9e", "sighting_of_ref": "indicator--dc8c3bbf-9119-4c37-b590-26c44b72b5bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0adac99-ff9a-47e7-a6c0-3e9ae746a551", "sighting_of_ref": "indicator--498610ab-706f-43cd-8a72-eae14a2170d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f217a1-5b2b-4c10-8990-4af1aac5d913", "sighting_of_ref": "indicator--1bdee8f4-57c4-48ad-8de7-5be074311a0a", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11818e2-5617-4813-872c-e8fd754c1657", "sighting_of_ref": "indicator--0bee43a0-41ff-480f-b0a8-a3bd684d6b82", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528b2e5b-5c48-41b5-a9ca-085a8cd4b9e7", "sighting_of_ref": "indicator--ca00b4ec-7827-4c36-8c4c-f2d0f74b63c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9bfc99e-17f7-40aa-bc2a-9d667a5d34e0", "sighting_of_ref": "indicator--277fa4e7-c13f-4df7-ae14-734f123da708", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b15d0f37-906d-4170-b653-146a589a31fb", "sighting_of_ref": "indicator--e5ddc0a9-ee73-41a5-a2f6-c67ae44f6bf3", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3207d693-f8be-4f2a-8eec-23369d1e7212", "sighting_of_ref": "indicator--622c7fb5-e56d-448a-94eb-48e78fec10f6", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe4b9f7-defe-4b97-96d5-fb8ac743b69a", "sighting_of_ref": "indicator--72d29f14-bc28-4b05-b6e6-34769a6b1bbf", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66e130ea-0379-40c6-b4ab-1eb8c0a22677", "sighting_of_ref": "indicator--106fa3c8-a5b7-4d29-82db-5c8f590540df", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba9816fe-737e-473e-9cc2-406a95b0faab", "sighting_of_ref": "indicator--e5fb6ccf-aee3-4d06-8136-b41837c3adb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d56bb6e-0ca3-4ace-95f2-a8a714f1c9a5", "sighting_of_ref": "indicator--f81fce22-f244-496d-bfbd-76d01b467e94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621390b9-7188-47bd-b41e-fcbe05f87ecd", "sighting_of_ref": "indicator--99532b6d-fc4e-4563-a58f-622d3a5e4d83", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--323c74ae-ddf0-46e5-a13f-95e529fb7655", "sighting_of_ref": "indicator--0ed42bff-a5cd-4cb8-82d2-1c7de8a1365d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1496381c-39c9-4191-a2d3-d61ed28b6885", "sighting_of_ref": "indicator--b2127ffd-6d4e-412f-bb73-8d4c35506299", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd47a84-15a4-4ce2-8cc4-5cf77311f6b9", "sighting_of_ref": "indicator--2521b0b6-cd78-4ad7-89c4-94ced849abc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c0de47-fed7-4863-86eb-5423ba8b1f11", "sighting_of_ref": "indicator--13af3df7-97ca-426b-927a-37fa3a2d072f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4c785d-3653-400f-8439-f4ed0c0111cb", "sighting_of_ref": "indicator--88e190e2-d734-4a1a-a97e-543be371f6f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a690513b-401c-4452-ad1c-3f780e42e88d", "sighting_of_ref": "indicator--660b1b9c-5df2-4f7c-9ba9-423caca34268", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d08e7d42-f2b6-420b-9e13-599c73711380", "sighting_of_ref": "indicator--f066c6ac-0501-4b05-8a7c-0e32e4efe7e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87721543-b701-404e-b541-eeb93cbf42e5", "sighting_of_ref": "indicator--05bb6ad3-dfda-416b-9626-b5d4894726d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd9ac2b1-cf5e-45ba-8754-9026f269d8a8", "sighting_of_ref": "indicator--552ea42b-da46-4a9b-bcb8-49e858042f7d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d864b0a4-23f6-43de-86cd-83232673e219", "sighting_of_ref": "indicator--d170d332-a6ab-4b5a-bcce-49f398d5566b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c77fe2-9f85-466f-87fa-06377332aed1", "sighting_of_ref": "indicator--3302c103-5a5c-4ee0-9971-aa6ce3128ad0", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30c4300-1b35-4f1f-9b79-b4d19c0e7a88", "sighting_of_ref": "indicator--3c3e75d4-757c-4007-8cee-6a63c6a52b03", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8c0f270-89d8-4a6e-81ec-febb25ebc03f", "sighting_of_ref": "indicator--bb647e89-f1b6-4a31-8558-eb673d75f7b1", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2b1fc2-7827-40e4-8a17-27f3a8584922", "sighting_of_ref": "indicator--697b9932-b52e-4cd3-8529-8c99c4c4fa04", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f00f10-9aac-433f-871c-b932aceb7aa5", "sighting_of_ref": "indicator--fc8977d0-ca93-405e-b2e6-24b809f43d85", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5966884a-7324-45bc-846f-fb624024488b", "sighting_of_ref": "indicator--5e906413-5203-480f-a604-a6830373fc72", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b3282b9-a865-47a4-8092-883a8c9e1ce9", "sighting_of_ref": "indicator--cdce0a57-a5b3-4cb7-9568-a51d0e8bdd35", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13ac241a-d7f8-448e-9b19-a23acdacc45d", "sighting_of_ref": "indicator--8c497e01-ed23-47a7-ae74-60b4f2d9dd83", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e04645-2bc9-4990-89d5-391fcf1dde55", "sighting_of_ref": "indicator--536f435c-c1eb-4475-9512-7e0d06f594f2", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d8c060-2853-432e-a78a-737b3ed3e35e", "sighting_of_ref": "indicator--53a7a0e0-6c17-47f7-bea5-1c804e905606", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bfd4a9e-4d8d-4e71-92dd-fa0ef8e0feb2", "sighting_of_ref": "indicator--2acd8dfb-16e3-4020-a22b-ee588fe5438e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--391d51fc-ec78-4424-8780-25ee70d025da", "sighting_of_ref": "indicator--5623e5a2-88c0-4a1d-a821-e9ea271f93e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92c0afe3-1a94-485e-a36e-9f3a506d7993", "sighting_of_ref": "indicator--40891bf3-83a3-4105-a5a4-dbd82da25ba5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a0f6e67-1f1d-423c-ba47-aaede4d3be27", "sighting_of_ref": "indicator--15e960e7-0824-4f2a-ba22-fe7918f116fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6526d91-eeba-47ad-9ddb-b8cfb0c83282", "sighting_of_ref": "indicator--80550142-8236-4424-b216-a4fdb0a35175", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7691e046-195d-4728-bb6c-ed7774a3b331", "sighting_of_ref": "indicator--f4db7eda-56d2-41f0-883c-891ca0a8b214", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--241457cb-0858-43bc-b3d7-591005af15dc", "sighting_of_ref": "indicator--a229dbab-bec2-49f6-be66-810b0ffdf840", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb99704-877e-42e4-9838-1bb3f2c4de04", "sighting_of_ref": "indicator--30dda65a-3aa2-4d34-8770-4beb4f61244d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--745119e4-d88f-4cd8-9fc6-ea9277e619e3", "sighting_of_ref": "indicator--ea725af6-6b2b-46ef-842a-f98acb31329f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba87dc08-e185-444d-836d-93bc33117a6a", "sighting_of_ref": "indicator--6c586095-6c12-4639-aa41-b57a0f4e6614", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9673c99-7346-46f2-9d86-4f1bd1681bc1", "sighting_of_ref": "indicator--23821cb3-0eab-4a77-939f-5bc2336611e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aacb5d61-00dc-4d17-95e4-18174b356685", "sighting_of_ref": "indicator--dd4466b7-ed85-47ea-a0d8-b0ff78329196", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--584230ed-151c-4e26-84fd-a7c14adcd197", "sighting_of_ref": "indicator--b77c0f75-0744-4047-bd34-bd67d04b046b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc94d92e-85dd-4f4a-aa6d-a49440ed802f", "sighting_of_ref": "indicator--afa6fe42-28f2-4757-ba95-26b086274208", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfa9a98-e4e1-4ef7-a9df-213cbaad3a38", "sighting_of_ref": "indicator--d62a0138-8286-4a03-aa13-5c9588c079aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309bc59c-15c1-441b-a179-7d822f7119f2", "sighting_of_ref": "indicator--4b5ac460-a081-45d9-bcc2-3cf2365ff6d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2e12886-b716-44f5-9eaf-d5d2d47a6109", "sighting_of_ref": "indicator--8030b229-bd78-4181-8d82-0d6051b740ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f06c2ebd-923d-4d51-bc43-6782d76cfd30", "sighting_of_ref": "indicator--0ae4c81b-2657-4fbd-a2a1-68368cbe2455", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5f7388-efdf-421a-9b57-82f3adec42a1", "sighting_of_ref": "indicator--842c529c-5de0-4765-a54b-812745e66526", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63138870-e288-42a9-b715-fea5471d95d0", "sighting_of_ref": "indicator--bd70cfb3-0aab-4bae-be16-8d7292c61aef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4ec1685-b6cb-4eda-97b4-a99c669e76c2", "sighting_of_ref": "indicator--36d3416d-6e6f-4c37-8881-8153fe3a6021", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c968e9-7868-44cf-b357-0dd2f2fda49b", "sighting_of_ref": "indicator--cacf7d86-ad53-4276-b168-224930b0fc74", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d810d87f-18bf-4fc1-9523-90e52b21f9fe", "sighting_of_ref": "indicator--5397e75b-83fc-4f29-94a9-56ee804d758e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6a9da77-ae90-4fd7-baf6-40a30148caee", "sighting_of_ref": "indicator--be898d3d-d71b-4266-9942-7188caba2f00", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b33db66-0d53-4819-8e07-9a57479f22a7", "sighting_of_ref": "indicator--711fa530-4d7c-4443-a9e1-517e01a647c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1e5be50-cbe3-4e49-b984-70c31849ae39", "sighting_of_ref": "indicator--de7102fc-3025-471a-bbb6-7aedc49e9e60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac402543-6eb0-4c81-b5a4-74637564ae04", "sighting_of_ref": "indicator--47db25bb-6590-4795-bf1d-f9663533d978", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4118a3ec-1ac0-4afc-8414-e5703957d027", "sighting_of_ref": "indicator--9ad5e872-93f5-455c-9af5-c9cf57494abc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613b541f-2762-4c0b-b0b0-b7c534fdfc4d", "sighting_of_ref": "indicator--8a3d7a54-bfd0-46b1-9c57-4320233963ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c1d8926-2a65-4560-88dd-5c88756ee030", "sighting_of_ref": "indicator--10f5eb59-393c-4d83-88d5-8327467a37aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c40cd3d7-f1ed-4de6-ba3b-c0ff2131fa24", "sighting_of_ref": "indicator--34388293-a717-4efe-8f43-a486b397d41c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a021dcd-3ef8-49d7-8078-ba29a716f1a8", "sighting_of_ref": "indicator--5dc5e19f-f09a-42fa-9f90-3b8bd6fb11c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--675ee781-12aa-4281-b10c-c29121aa621c", "sighting_of_ref": "indicator--cd265600-20ef-4a90-9a13-9e0ab3394db1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66da9022-299a-47bf-be87-a7a15f90f00c", "sighting_of_ref": "indicator--73d56358-051c-4cd6-a76e-f3df4c2abf80", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7592f8a1-3018-4f06-babe-d12a2f9e22d3", "sighting_of_ref": "indicator--b4e2e13b-94fc-4f52-9cf6-dc039499db70", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e5ca837-b469-4267-9d9d-501321ba4472", "sighting_of_ref": "indicator--81011f94-0fe8-4d92-80c9-8728c95971d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79cd41dd-235b-4b66-8470-c124c64cb01d", "sighting_of_ref": "indicator--616dfacc-1d05-435e-a54c-c40bb348a488", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--614ee420-82b1-4ee5-9cc5-3323f5d434ef", "sighting_of_ref": "indicator--f17163d1-8536-42d9-b7bf-5c1ffdfdbd2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de98b880-73e4-41f7-8f7a-eaf6ca81864c", "sighting_of_ref": "indicator--8e6fbb68-2f3e-4ab5-bc5d-3a38b341befb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaf73bc3-19db-4989-837d-212c50c7572c", "sighting_of_ref": "indicator--f0c224b8-ca60-4b80-9aac-9af9599c2c7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5689bf81-8690-43ef-b5f0-50eed590c849", "sighting_of_ref": "indicator--15f18ee1-d49b-4c9f-8514-81ffe1595a20", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd4a6b9-2aa3-4dde-936d-66536c96b06f", "sighting_of_ref": "indicator--b49486ff-a8a6-4940-9c27-12c3b1326f9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41c2a4e4-ac62-47ab-93e3-0a8dbf54de09", "sighting_of_ref": "indicator--e6832276-38ad-4548-960e-0abb04fe3c7a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e87bcf83-191e-4711-bc0c-db9ec6d5bf59", "sighting_of_ref": "indicator--b63fa6f6-de23-4a72-ab45-c24a3d52189a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9497ffee-398d-484d-8aa4-ca1b7cebd14e", "sighting_of_ref": "indicator--c0c8657d-8cef-4163-8920-30fb797961c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b28befd-3451-48ae-81c1-b9d2b2274889", "sighting_of_ref": "indicator--6fb3dd51-4e9b-4501-882c-13128328129d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e246f5b2-0e6f-46d7-8b32-f60e9213b93f", "sighting_of_ref": "indicator--74a1faa1-3948-4659-b044-9776f6b7922a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70adc4c6-3ea6-4b96-a540-d10b10067078", "sighting_of_ref": "indicator--4f24cb4d-4bba-48e6-b27a-2daab81f72f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7551a3d-14e4-45e9-8e7f-1747506a9808", "sighting_of_ref": "indicator--a02703a0-f795-4025-8ada-220517ec0dd6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc23f569-eba0-4fd3-bfbc-0091ff09b05c", "sighting_of_ref": "indicator--66df543a-8dd3-4523-9706-f2c4b3c88a5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21545fea-6c64-4c99-828f-c10203f52296", "sighting_of_ref": "indicator--d6028bff-2880-4abc-b13f-df42a26e0859", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bf7ae0b-5caa-4c06-8485-f49c79df60aa", "sighting_of_ref": "indicator--36642815-8f1c-43f2-9a23-70718deecd19", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--626cd666-5094-406d-88ad-08f6f6ca2bd6", "sighting_of_ref": "indicator--45e41707-8229-4143-8617-5e46369f8f35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5cbcec5-3315-4a0b-bc7f-89a329ea2524", "sighting_of_ref": "indicator--723342a5-7288-48dd-8f8b-c937b0c2f628", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5410e3f-423b-49f5-bf0d-c1f447f5f387", "sighting_of_ref": "indicator--d8dea7e5-5f6e-447a-8e17-1c532ca07e38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35ad5d1a-8f28-4332-85d1-324760e87a6a", "sighting_of_ref": "indicator--f3421831-43f0-4e80-addc-8a05f27469ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ad8ae3d-cab7-4528-81bb-cc36cc019884", "sighting_of_ref": "indicator--9a963dcb-9971-4265-b6e5-419f2101eb9e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44791d31-e1cb-43d6-8ee3-8bbb540b8bcf", "sighting_of_ref": "indicator--cfbf480e-5d59-4379-80db-f92e5157e34d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71c13945-f33b-4cc5-8d69-390ff105eb75", "sighting_of_ref": "indicator--935aeaa7-aacf-414b-a113-1122bc80d7e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90062430-89e4-4170-8608-bc59b83efa89", "sighting_of_ref": "indicator--4ab54784-0566-4f9c-9114-2213e9c29bed", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a403271-14ba-4f53-a1b7-6dd47a8e5545", "sighting_of_ref": "indicator--29f30a51-2ded-4c19-98ca-1cf1ca28c7be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62818ee5-d567-425b-a89b-73a6cb5fe8fc", "sighting_of_ref": "indicator--b2200a46-ded7-4fcf-83a2-2e79dc3e6830", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce267ff9-4435-4aa6-885d-0973bcaed009", "sighting_of_ref": "indicator--0af34594-187f-4579-b908-544348de7fbe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad4fbe8-c45d-409b-b880-e1ac497dca41", "sighting_of_ref": "indicator--23f93efc-4c96-4e82-8b0e-d7316fcd73de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--603451a0-0bcb-4c9b-99b1-f6c812ade9da", "sighting_of_ref": "indicator--353d16d9-1bc9-4521-b290-f4acf685a1b7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1235c43-2c28-4999-99f4-2b248f67b89c", "sighting_of_ref": "indicator--9130ce09-a70e-436d-82ac-320cc0ce9e90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08e0885-2317-4e0e-bc8e-56f5a22ed855", "sighting_of_ref": "indicator--035a27ad-1213-4d58-89bd-e3e0413edef9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--439e2665-9df4-40fa-8803-0671cc43695f", "sighting_of_ref": "indicator--05187367-fd03-4188-af79-6925a16257e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c35c18e5-214f-41d5-8a69-ead25fda7cc8", "sighting_of_ref": "indicator--1b6d2c37-061b-42d2-8ddf-ab242361f884", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33756df-ec6e-4a12-9cb7-0922b3d23dc6", "sighting_of_ref": "indicator--7dcb1633-8a7c-4e5f-8161-c395c8616af4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ed5744-5e72-4981-9274-a071fc564bac", "sighting_of_ref": "indicator--149e61b2-f21f-4a13-90d9-ad1456dcb9a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b599742-d935-49f7-b325-d4b4cce6e76e", "sighting_of_ref": "indicator--69350fda-5b59-4b7d-b710-52d0f64db249", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1eb744-df54-4e8b-a72b-dafa616b0181", "sighting_of_ref": "indicator--a5da7ac3-7347-4dbc-98e2-b801aebe08ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--698db23d-86f7-4f8e-adcc-2f0d89ab81d6", "sighting_of_ref": "indicator--a53078f1-f24d-4e77-aa60-8452ce0726c6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4e90eb-1cb2-48a2-85fd-623f9034971a", "sighting_of_ref": "indicator--276bcb49-e40d-48c8-9104-f8bbf5ec6a7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9acd48b-0263-4b04-832f-49c322eba340", "sighting_of_ref": "indicator--e649d35b-f5cb-4f9c-b130-20eeec9b139d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e5ef5c-b6fd-41e9-855b-0e981209f31a", "sighting_of_ref": "indicator--3d462583-d084-47bf-b837-44023deed221", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed0ec5d-0327-455c-94aa-c0dc18808c46", "sighting_of_ref": "indicator--70905438-38b3-4a02-af16-b164a8951a95", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b55eb38d-4bbb-4d6f-bebc-30f0eec2a53b", "sighting_of_ref": "indicator--43fcc3dd-1fc6-428f-be31-5be26eff15f3", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93d93211-5dec-44b6-abbe-e0894dad270e", "sighting_of_ref": "indicator--e4716c5f-e01c-471e-812b-74c4d7e6f4e2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53296478-87c6-44c8-b4d4-5ed6323962f1", "sighting_of_ref": "indicator--9c67068c-9621-445b-bc9f-2471eee5250d", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ef0f69-e3a6-4c1a-83a0-53ed2605a959", "sighting_of_ref": "indicator--c58aed18-6489-442f-8576-f1c0c313e541", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d5422e1-3659-4172-9eda-1c477db27806", "sighting_of_ref": "indicator--0c051d6a-912f-47ee-985d-cb11e9c21c22", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2a396e5-da63-4500-9d20-98be2af1a0de", "sighting_of_ref": "indicator--c1c1351f-944b-46c4-ad1d-eeff5cb57ea5", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19bcef20-de87-497e-840c-3c01bd9b0405", "sighting_of_ref": "indicator--771f6464-b75f-4bd1-b214-7f713eec2018", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c67ba13-e4e5-40ca-b488-36a2090e461f", "sighting_of_ref": "indicator--a4dcb7e0-4b5e-4e41-a758-25a0b7abc37c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ef2b6f5-91ca-455a-bdba-4ff4c4ef1800", "sighting_of_ref": "indicator--8f86a868-87b8-4082-a230-0e2aa565a916", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8669dda-a24e-414b-8ede-c9c2b4ed8c0b", "sighting_of_ref": "indicator--15897449-ae39-45b6-aa20-7bb7db9dd8f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec3e6b7-77e1-473c-b9bd-4e4b2b2eb0db", "sighting_of_ref": "indicator--caf658c7-e683-4b5a-95e4-ea493c83068e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc00617a-c94f-46b7-a981-63d00931306a", "sighting_of_ref": "indicator--888d3dc3-da54-4a0f-8673-fd8ccb5ee5f3", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e3e4107-5d1c-4ddf-a42c-7a08f460fc4d", "sighting_of_ref": "indicator--da9badb2-638a-4bee-a17d-a72c671bb291", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c55fb2ee-8cbf-44b4-bfa9-1a4edb130fcf", "sighting_of_ref": "indicator--3a3e1d21-28ac-4c06-b465-f5e53bc445e8", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba47f2f-cdd7-4924-a674-7fe17eea732a", "sighting_of_ref": "indicator--1183a40f-ac2f-43ef-8f9f-01bc86b017e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d871cb8-d093-4083-8a18-97e0b75c70d3", "sighting_of_ref": "indicator--02578c31-bb3d-414b-baf0-e18e263914ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--007777dc-c67e-4cc5-a767-33e739a2226c", "sighting_of_ref": "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b08dc9f-e92c-42d6-81c5-54a5f122e4c2", "sighting_of_ref": "indicator--58b850a7-cddf-4fa7-9bfd-a3c2fd994b27", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7219a0d7-ca16-4bd8-ae90-3ecb8f385d5e", "sighting_of_ref": "indicator--b7177c1b-e7d5-40b5-aa64-cc785f203313", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404142bd-a2db-494a-9900-736b5539dd52", "sighting_of_ref": "indicator--b3617e02-0ee1-43ea-87fa-47be936e8849", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a7cdf6-8019-4604-aa31-8fc30f1e7bd2", "sighting_of_ref": "indicator--26db2c32-aa2a-4af5-9a08-724c51917255", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbfbba39-c12b-47c5-b672-5076a7d7e10a", "sighting_of_ref": "indicator--ba72da84-244b-4829-bb7c-2de1ac898b9b", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab53bb4-b75a-4f4e-98ea-e7a5b1aeeda7", "sighting_of_ref": "indicator--0bafdca0-2a91-461d-8087-e869b0fd37ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cecef870-ddc9-4160-862c-841720decd67", "sighting_of_ref": "indicator--df456f2c-71ee-4c76-a53a-bbacada1e13f", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70ebd07e-4cd1-4a12-b294-814ba7f16d44", "sighting_of_ref": "indicator--205c9729-78a3-42fb-861c-42438d12ac43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcbcbb61-f917-4f08-ae62-24219aaf2d3d", "sighting_of_ref": "indicator--5b1f37ac-1074-4f1a-99bc-36e5ba3721ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da8423cf-3a90-4a96-bc2b-9b2aca6bce08", "sighting_of_ref": "indicator--fef4b46e-dad6-42b6-8285-7d5e175745e5", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--899f4898-376c-41ec-a1d6-8dbdb6c76be6", "sighting_of_ref": "indicator--a9c4b9d8-ff05-47a0-9d2a-9a608301b0ea", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65892dd3-b7ab-4163-9ef5-156f368ebfca", "sighting_of_ref": "indicator--cf35bd09-1dee-446b-900d-0f120a6afc0e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2a07f8-c7bf-4121-9154-44b12c7fc270", "sighting_of_ref": "indicator--cfc0213f-38da-44a5-8c75-1b6990f5fc2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e431101-5897-43b0-a4be-a49615e55cc0", "sighting_of_ref": "indicator--f5740431-3fae-4e87-a3b6-8e2d3a1b1ee1", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03cf28f2-e124-4546-a4e1-6de514e57241", "sighting_of_ref": "indicator--e3745789-94df-4ed5-ae77-9531ad5fcb79", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10654ff8-1a29-43ed-9388-9901804d510a", "sighting_of_ref": "indicator--fe6ac659-59bd-46c7-b767-360c19c20a52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a65a03-5fbd-46fd-90a8-b055bb57180e", "sighting_of_ref": "indicator--bb3299e2-c867-498c-9986-a8c31e4c28f0", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12874641-b9b4-4a8a-a792-b71231a79b5e", "sighting_of_ref": "indicator--f7374d64-2c63-4f83-98fd-09e5a354a9c1", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--603513cb-a5db-4dac-ae92-59539fecd773", "sighting_of_ref": "indicator--c13af42e-f03d-4893-8ac1-ffa38cf78b3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f80f45-efb9-41cf-b8a5-af11544906e9", "sighting_of_ref": "indicator--3c9368b4-4561-4d10-bbc0-8b66e3d41073", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5addf74-cbfc-4f83-a8dc-14c72bc75009", "sighting_of_ref": "indicator--89fb2b3c-b383-4bdd-aebc-da0daf85ed5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c08ea0-5492-4fb4-8fa5-df92e8e4458b", "sighting_of_ref": "indicator--64b45716-cb57-44ca-a8c0-7ec88da89d51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--354b9e22-25d8-48f1-b7a1-2e1b9e3fd52d", "sighting_of_ref": "indicator--2dc93353-7afe-4e6a-90a2-74e214a61355", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1efd8dba-c238-4254-a9fc-1a3ac277ddef", "sighting_of_ref": "indicator--62258b92-629c-43f3-b559-41f369e3c14d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3231d46b-1822-4189-be48-e5bbf05486f4", "sighting_of_ref": "indicator--b5a186c3-f24e-4be6-855a-e5b5f7fa8d71", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44e7015-4a5c-437f-9c65-9c3c5ad542dd", "sighting_of_ref": "indicator--b7e18bee-5bb1-4b61-9668-546ad4d72597", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4bfb9c3-062a-425a-aca8-2a02b434dfa2", "sighting_of_ref": "indicator--5aac70d1-e7c2-43c9-933a-dbd75e7165c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d289fc6-df65-4892-8649-fe5a91b2a73e", "sighting_of_ref": "indicator--4591b193-2b11-433b-9057-2d4d29250319", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f86549aa-efa5-4346-a79f-003232fbe3c6", "sighting_of_ref": "indicator--8b88a5a5-b540-453f-b9e8-6257047a5e19", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bb52314-e90e-4255-aed0-7b7dfd4fba3f", "sighting_of_ref": "indicator--84c5cede-7a3a-43c6-a7d8-7a5d9c38de85", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42103756-6f84-4fc4-a88e-b98ecca3fc0b", "sighting_of_ref": "indicator--d33b873e-0c47-4ceb-aae1-12362e1f4831", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37bd4de3-c978-4501-8984-a16d5fbb2fc8", "sighting_of_ref": "indicator--cf02681a-c871-4dcf-add7-626a033b413b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc9a23bf-8185-49bc-a433-9649d6742002", "sighting_of_ref": "indicator--6810b7a6-6366-44d1-aefc-1123fa2aa924", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec8e119e-9dbf-421d-afa8-38d0b45078b5", "sighting_of_ref": "indicator--11f147ab-ff0f-4e23-bafa-ed2395183b77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c4ccf3-663c-4702-9d7e-ed6b9dc4f447", "sighting_of_ref": "indicator--fec2809e-18df-4e60-b10b-d542c20fdd6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--141162bd-bda8-40bb-8eb9-49f6bc944e0a", "sighting_of_ref": "indicator--d71af5e0-a83a-4c44-baf5-fdb66f8a434d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb0d8aed-b971-42b7-9ea1-556f8e93b14a", "sighting_of_ref": "indicator--d785035a-1513-4e2b-afb5-58c76240223b", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5595cc15-7845-47bd-b1f0-7412cdf9f028", "sighting_of_ref": "indicator--09a77fdb-218d-4cd7-b0c4-116646e7864d", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--235d7bcb-d07e-46b5-b715-fe87cbfb3e8f", "sighting_of_ref": "indicator--c9cf2473-2973-4f0b-a103-91a7a7e4a454", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe2c37db-a922-4824-af85-87a18c459a3a", "sighting_of_ref": "indicator--c84c5011-8a3a-41c9-9dad-11d06f7edf10", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c777887-cfc7-4233-8c18-31a585dbce79", "sighting_of_ref": "indicator--278bdca3-be4a-4109-942e-cfa5b2d216c8", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faeee112-7bc1-4d23-a807-4b31c335fb3d", "sighting_of_ref": "indicator--8bbcc595-6c77-41a8-933f-ec9b9c76cee5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--050f129c-21b4-410d-84d9-214ac6791b24", "sighting_of_ref": "indicator--57766950-c112-43db-95d2-5154c27f9cc6", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90bbe6f2-3b50-4b50-b823-9c79fcb0155e", "sighting_of_ref": "indicator--36b737c4-a2b9-4e37-ba60-58d497049bf3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f5a37a-871c-41b3-970b-1142632fc601", "sighting_of_ref": "indicator--ea94379b-d725-40c3-be44-616bd8f3f817", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96d94567-c5d5-4b9a-b33d-dfa066a25c66", "sighting_of_ref": "indicator--d66ab795-5a8c-4985-9068-05e5c2cba3de", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9699b52c-08f3-4e34-88c5-a92f26825491", "sighting_of_ref": "indicator--5a479991-108a-47ff-b85b-689066453a96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd003e72-1952-4412-98e8-beb456bf93ef", "sighting_of_ref": "indicator--7262872d-b229-4ae4-a321-c51e4799646c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad41bad-9426-43c9-b536-63b1ebd02c99", "sighting_of_ref": "indicator--f319e713-d6cb-4c50-b59b-d1f39ed02ab7", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c8b50f-3d39-4b4f-b443-d9c67fddac2a", "sighting_of_ref": "indicator--3148b789-d705-4fe1-a3bc-ada0e610d5c5", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c018d71a-f329-4709-a70c-81eb0373b113", "sighting_of_ref": "indicator--a8e45bc2-54e7-4d8f-826f-aadba5ba300f", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b04ec35-3efe-464a-870a-87f6cbfe580f", "sighting_of_ref": "indicator--433d3095-b782-4cb3-90a3-68ae0f6cdb32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42a58eb-6f90-4b0e-807f-acdcd6f1ba1e", "sighting_of_ref": "indicator--6bfb6690-6db5-435a-9af0-020ea9d8f10d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de5c301f-c258-4173-a4c1-68a0a1df69ab", "sighting_of_ref": "indicator--6e2a8ef2-d2e4-4af2-b366-f08067da670a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e290cab2-4e9d-4deb-86cd-a4f3c519e5fb", "sighting_of_ref": "indicator--d7a3e34d-b271-440c-95c2-8e3b08594b9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--791e5823-675c-41fe-a8e1-7fc98c4e7287", "sighting_of_ref": "indicator--462f08a1-d2e2-441b-a797-8d446088a567", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c385fc8-2a0a-42d9-9276-15d1d76484c7", "sighting_of_ref": "indicator--8114b2de-6862-4b18-b231-1da7de9084b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8092f8f7-10f4-4652-aa2e-da13bbb6461b", "sighting_of_ref": "indicator--7844ced1-a6a4-4242-a9ec-255033fb6e0f", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a313d5e0-5b29-445f-ad1d-cb51ee419b21", "sighting_of_ref": "indicator--3c6f0397-c3db-4073-ab65-87ecf58ac787", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d07f387c-4a1c-400b-bf0d-43439452dbfe", "sighting_of_ref": "indicator--8c2711f1-7343-4c8b-a1bf-d8ea8f8ee67e", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--559d0d7d-79a4-47c1-9c1a-72a3cc2e5a5a", "sighting_of_ref": "indicator--b228bedd-35c2-400c-926f-583af52543fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13f92a10-8ff3-42d3-9643-934ed4b8ff1b", "sighting_of_ref": "indicator--ab697c6e-6518-4eef-ae5e-d3f9b79f9b14", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35fb790a-ed6e-4559-b4b7-47b3fa17d53e", "sighting_of_ref": "indicator--d204625c-fa1c-472e-9712-1f74a47309c2", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3841d8e-3134-4788-a43d-459362ebee3c", "sighting_of_ref": "indicator--d0a29693-da6b-487d-aec0-8c6ba13da456", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c1b1f4-fd0e-4a6c-9c0b-ac96817adae4", "sighting_of_ref": "indicator--e0be2914-a512-4626-9e5a-2a4b2ed8c831", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de8bad9-aea9-4ac9-8622-9733aa4181cd", "sighting_of_ref": "indicator--afa56a1f-f060-4c45-a69b-edd9e792be71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e0ce57-9c5a-486c-9b8a-eeeae14bc0b5", "sighting_of_ref": "indicator--4b537957-bedf-484c-8442-3548cbca567c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--415067ce-4dd1-4faf-9288-d01d2f0b833b", "sighting_of_ref": "indicator--f9055fbf-4909-4c70-a2c2-9f412ac8700a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8fe89ec-8c4d-4da0-a09d-4f4c75413309", "sighting_of_ref": "indicator--fb1159f2-2f95-4899-84bf-f6d26561b20d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58c3aad0-8cf5-4b32-ae6e-9922842320fd", "sighting_of_ref": "indicator--3d8b66c7-ec20-49b9-8e7a-8988bbc12cab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54fa077e-f0cc-4366-a429-8a84c4e20673", "sighting_of_ref": "indicator--720b3aec-2a6d-456e-a539-877e8f1870e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1dcb73-b8cf-48f8-9d9e-ff675be37c09", "sighting_of_ref": "indicator--df9d54d4-8ef6-4111-bb76-74d5f2692f56", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3306b97-0f73-47a7-92db-773a2ea373a8", "sighting_of_ref": "indicator--637fb70b-e04e-422a-a3da-736c0fb9f58b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a34a1143-d012-4b67-9b66-0a04ac0ec50d", "sighting_of_ref": "indicator--b314498f-da05-4f21-97e9-6744319af556", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0d95ed3-19ec-4625-ba1c-e96a1a79065e", "sighting_of_ref": "indicator--2f04b4a5-db92-4bef-9a5a-9835ccb79c5a", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33d8fde6-cbe7-4218-a09e-cee935594215", "sighting_of_ref": "indicator--0db4a589-4079-4f6f-897d-832933078d49", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--939db58f-ce0c-4765-a3cf-0f3113cf9e28", "sighting_of_ref": "indicator--58db5632-643a-404c-ac0e-4a1133940c94", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a2f3968-e7e5-4e9a-924b-3e6b5bd072a2", "sighting_of_ref": "indicator--3885541b-2cc2-4f2c-b410-1637d1ea6641", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8be78b4-7328-4f37-8028-23979e72e98e", "sighting_of_ref": "indicator--59f82471-86d8-4f55-becb-21c0ef90fde1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85ceb8e8-524a-4782-9b3e-e71ac85d01b9", "sighting_of_ref": "indicator--76d06f28-89c3-4db6-800a-166073b72eb5", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12ac4204-ae82-429d-86bc-06ebbc62c5f6", "sighting_of_ref": "indicator--45f8542e-312c-4b82-b7b2-1c1a9fd75766", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689fdf06-b700-4a71-88ab-7c0a1ea4ffdd", "sighting_of_ref": "indicator--f5737c15-bc0c-410d-9033-659d671ce7eb", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20169e3-f48a-45ba-bb21-1c0356726854", "sighting_of_ref": "indicator--45e473d1-8646-466e-9b9c-0859c7e6b305", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa760d93-e844-4934-978c-44bc932042a4", "sighting_of_ref": "indicator--859ddf9f-5449-450a-bb79-cb5b7dfaf9f3", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7062a3ab-5177-4e6d-85eb-3a98658fab26", "sighting_of_ref": "indicator--9e326ee7-db55-4143-ac60-255c5d0e9594", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a79b198-bacb-4906-91eb-f231e3d194c3", "sighting_of_ref": "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36ec8a50-22cd-4795-ad3c-c9c97783a2cc", "sighting_of_ref": "indicator--e06ed415-4593-4b68-9c14-ba1507a5ef34", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3654f7a-3dc1-4f6e-8e7f-1748abff0eef", "sighting_of_ref": "indicator--a73a0fdf-e2ec-4c41-87e0-421b872d8444", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df2e12ef-859c-4aeb-ad95-508c31d07ddb", "sighting_of_ref": "indicator--ef10b2a4-7771-4021-954b-fc8a98031db3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b45856f-01a8-486d-bf24-d02cbb853668", "sighting_of_ref": "indicator--e785d3c3-b4d6-4feb-88e9-7e5a0891d9eb", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e69898d5-0068-4bd6-96c4-ae878b56653f", "sighting_of_ref": "indicator--ef738523-ab44-4f7e-bc36-01b6482acf34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b40bfe4-de28-4d9f-8667-45d5cfcbec61", "sighting_of_ref": "indicator--33375e9f-cea0-4b16-b721-9bcb08879e19", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09c61b6b-e471-4b73-874a-972b22098aad", "sighting_of_ref": "indicator--994aa906-cc4b-4f00-ac62-826cc1ecfd1c", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec009633-8274-4260-9178-2f18f4df8b60", "sighting_of_ref": "indicator--1978240b-1de1-4519-8e4a-44807b104711", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--181fb3c9-631b-4a4e-b556-b4af030b9054", "sighting_of_ref": "indicator--26edbd14-7f6f-47fb-bdb6-097dafc266a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49543c14-7576-45db-a3b7-51b70fc06f56", "sighting_of_ref": "indicator--591288fc-922b-4027-8725-32c48eb45a4c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c019847-b4bf-4bfc-b783-f09990be0678", "sighting_of_ref": "indicator--d89bf381-48bc-4d4c-9faf-c34578925acf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec81f3d9-ec88-4c5c-b674-4e2232fba813", "sighting_of_ref": "indicator--b18b02ba-28f1-4e17-967d-c72f14f4bf87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dbfa84d-5b92-475d-992b-371c91d893cf", "sighting_of_ref": "indicator--2f904b7a-40c6-4d8d-bd94-3bda4c37e94d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c293d92-2bb6-4008-b73d-0d3f6e104322", "sighting_of_ref": "indicator--b1147f8f-8862-4545-b001-fc67cf7fdd7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81678c96-dd1a-4a64-9414-0020168f8c50", "sighting_of_ref": "indicator--94692b65-12a5-43c5-9d43-b25b4f78daba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36c15155-7957-4ee6-9273-d0b64fee716b", "sighting_of_ref": "indicator--870a34c4-3227-4b45-b018-827f0cb41960", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7dbe285-52a1-4e71-8e67-c3d06729af4a", "sighting_of_ref": "indicator--e1978d0a-1dd9-4922-aaab-2df571480a40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c16c3d72-cc4b-4956-85ba-7659694480b2", "sighting_of_ref": "indicator--3a61cda3-db91-415e-a529-bdc204e0db61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fad1b4cd-b0ef-4b0a-a83d-7522614673a2", "sighting_of_ref": "indicator--9828a83a-2f98-43ed-ad40-c2ec3432d4ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acbcc716-f3fc-412f-b1dd-c730b876eed5", "sighting_of_ref": "indicator--1a95ccd8-46de-42c6-8f06-a26b9c7a5243", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--675fad0a-661f-4c36-a567-fd59b0a5ab22", "sighting_of_ref": "indicator--156406e8-5a78-4363-8aed-21855da262d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cbe886e-647b-49ac-af68-109dd7ab0673", "sighting_of_ref": "indicator--bcc17156-0f61-434b-943e-ad1ffca82bd1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da86fd80-3463-4a1c-b8a5-6b7bbc88b10b", "sighting_of_ref": "indicator--33d1fb49-5218-4325-85bd-ad9febd0f53d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3434d469-75bc-4dd6-9c9e-ef3560b6dccc", "sighting_of_ref": "indicator--bef222fa-d9ce-4d12-986f-c2edd23c51f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a011f97a-6016-4c86-b9ad-a4fd32dab5a6", "sighting_of_ref": "indicator--b2317250-d96e-4e39-971d-9cc9e23c36d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5cedc41-8587-4fea-83dd-b786d8ed1a0f", "sighting_of_ref": "indicator--72fcd580-50dc-4d2f-a42d-47c589a0f426", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f017f5-dd9f-4fa8-9332-1e26a6860c6d", "sighting_of_ref": "indicator--47afc981-7a46-4ff8-b884-4129d2962b24", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc039525-e5ab-4701-811b-c38a7a3059af", "sighting_of_ref": "indicator--cb756a73-1fa4-4357-9262-56fec3d5fee6", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--503d97c8-2d60-4d5c-9840-2dd18652a6ba", "sighting_of_ref": "indicator--c753fa5b-8d36-44ec-a52e-5986b970a223", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f4bafe-d51c-4bcb-ba3c-9c70570258ed", "sighting_of_ref": "indicator--11e58df8-4199-4fe9-b9d3-608dcb03dcff", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9939f44e-008e-4ccd-9f45-89ae87d20be0", "sighting_of_ref": "indicator--dd843fa9-1761-4841-82eb-20ae9e24f8b6", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa016e6a-96ce-448a-b4d9-4570c2925886", "sighting_of_ref": "indicator--6e746b26-1745-404f-bc53-4c625c6ed0cf", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7beaefd0-0025-44be-a340-be9cb3e736ed", "sighting_of_ref": "indicator--ee33ccc7-73fc-4a28-981a-7cb80606332d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c3d0fdd-f2ef-49ff-937b-f216c01e146b", "sighting_of_ref": "indicator--1ff22444-41ba-41a1-a447-bb03013c45b4", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5210703b-dbbc-4844-a637-cfb7237f32bd", "sighting_of_ref": "indicator--0ae9469f-10ab-4c94-b548-36c13c782fca", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b5c0478-524d-4296-8061-b281e138042c", "sighting_of_ref": "indicator--6a8943f8-b23c-4362-ae8e-067effd6d411", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61177482-ce81-43bd-960a-cc393378a1b8", "sighting_of_ref": "indicator--0a084835-4d46-4e95-8e36-256aebd585cb", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66011c74-b5c2-4b12-85ba-d8fdbfc986dc", "sighting_of_ref": "indicator--3ad6f62f-cb08-4a82-b6ac-7c8d986d8a4d", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535033c1-6687-411e-8e7f-91596375d190", "sighting_of_ref": "indicator--85f9e9ff-30bb-4bbd-b991-81ada1701dc0", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13f5bd03-7183-4f10-a889-2d5cefffe254", "sighting_of_ref": "indicator--23d8230b-d792-4cee-88c4-8ab9cb3dc53c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0038987-6c4a-4d2a-bf65-1b1ac7e42989", "sighting_of_ref": "indicator--8d4d326b-7265-4924-8de9-3f89f4650afd", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f73d9c-9cc8-4009-82dc-058fefd1618c", "sighting_of_ref": "indicator--aa47ceb6-aa37-4deb-828b-7c789477d02d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e7a55b-e0a2-4dbd-ab4a-2f75626ab2b3", "sighting_of_ref": "indicator--3d52be6d-4669-4bd5-b7ae-96782c313ac7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fb2ae7d-57a1-41eb-ad68-74829806935b", "sighting_of_ref": "indicator--bfc0d836-63ba-4d22-b47e-75fbf4a64036", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb4edd57-66d7-45b9-9b72-4385d3ca3fa2", "sighting_of_ref": "indicator--cbfb4d85-0dc2-4041-85f4-e769e91f1cdf", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db9b9cb3-98ed-422b-877c-25309704571b", "sighting_of_ref": "indicator--a5627ace-354d-4e4b-985d-586aafc0fd95", "where_sighted_refs": ["location--1e152ecb-cc3e-4309-88b8-7888999520df"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43300f8d-5222-41a0-aa3b-56f5c3fdc0f6", "sighting_of_ref": "indicator--5881aaef-e1f0-413d-83bf-480bcbc1d2e5", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d9f496-c131-4ff2-8ced-8b6669469d43", "sighting_of_ref": "indicator--738399a7-47b1-47ce-ac34-d1ae362f6d64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b205c55c-003c-455c-83d0-7dd1e6dcca98", "sighting_of_ref": "indicator--a84d930b-bb51-4b53-bcae-585c99feeeca", "where_sighted_refs": ["location--5d7a7619-15c8-46e9-baf1-59b28d7733ae"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--946bdb27-c68a-4291-bda5-45fd5c7d3727", "sighting_of_ref": "indicator--20cf1ebb-4dec-4373-a108-b5d803f9d104", "where_sighted_refs": ["location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38da5476-d5ac-4cea-82ab-fb3d0b3cd0ba", "sighting_of_ref": "indicator--4a1dcb25-0cb3-49d9-8183-baf086a4a8e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-09-20T00:00:00.000Z", "last_seen": "2026-09-20T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--c4c33c98-331e-48ce-8f43-d457e4ca5f5c", "name": "Threat Report for 2026-09-20", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-09-21T11:00:02.976Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--1e152ecb-cc3e-4309-88b8-7888999520df", "location--a276497d-3f7c-4d7e-bf37-2c70a1dcb5af", "location--5d7a7619-15c8-46e9-baf1-59b28d7733ae", "infrastructure--50114f6d-11fd-4d6c-b5e9-67bee023a6e9", "infrastructure--13f515b3-0a27-4275-8c20-3062a3be7d9a", "relationship--a68687c9-42aa-4f7f-a22a-73d6a6f645b3", "infrastructure--b8d2dbca-655c-4f48-bb72-e297ae285b26", "infrastructure--49d4a0d1-d76b-414d-b98b-818357af7d9e", "relationship--ad97e624-4271-431e-ab43-a60b1ea5396c", "infrastructure--8cd11fe8-3f0f-44f8-95c3-f94cf4b17175", "relationship--b9720163-6c1f-45cb-a3ce-fb8d759153f3", "vulnerability--286a7ad1-ee46-4fd4-b182-a91e95bb39cc", "vulnerability--1b225dd9-80cc-400b-8fc6-dd5240bf195e", "vulnerability--3dddb23e-3947-4513-9e5c-a23f65603252", "vulnerability--6d5a1c1b-9169-473d-8fd6-3c26128c7ed2", "vulnerability--55626788-d599-4661-af11-0bdff1a5cfff", "vulnerability--35831716-8522-45a2-a30b-861c0c5b2cd6", "vulnerability--ad231ed1-38f8-44fa-b766-c405797980ee", "vulnerability--364c9cce-422e-42cc-bb3a-fa2d104aff9e", "vulnerability--683586a3-6bb1-4606-912d-73e1ace52b92", "vulnerability--17385e21-038a-443e-8292-8e585611efaf", "attack-pattern--9f5db41a-9542-4da4-81ef-00754c9bbfe0", "attack-pattern--1b9871cf-29bc-44c1-95cc-0588b915c1eb", "attack-pattern--148968c4-8f5e-4893-acdd-b5d70f6f9292", "attack-pattern--4f541653-78e4-4cdc-b6ec-dd1b562bf0d1", "indicator--6cf117a2-be91-4d65-b0f1-b5e4183bc521", "indicator--b88d95bd-c8d2-4f80-bca8-e5c27638e297", "indicator--9f8e2aab-eca0-4f56-9c8d-33ebc12a196f", "indicator--698166ea-07af-487b-9437-14debbf8aca6", "indicator--3b006395-e2ea-4be5-a66e-33e632d4e992", "indicator--c7f988f0-46af-4d74-b202-180021a15df7", "indicator--f47119e7-ec71-43ab-a867-786b38044570", "indicator--2f9c5f50-8a0c-433b-95b6-12ec7fb34f45", "indicator--de091230-87d7-4418-bba4-1cb148c92bc4", "indicator--5eef3da9-8f69-42c0-b026-f4ea12c7cb3e", "indicator--ff0e0d71-47ed-4288-99b6-5834ba964f89", "indicator--f8cea7c7-221e-4618-8367-02b03f3579d8", "indicator--b409f0d0-d820-4885-8428-dded7cda1e59", "indicator--8acc059d-2a3d-46ce-9beb-06455c2aa772", "indicator--e3328aeb-feba-4c08-9f72-231330ad18d7", "indicator--c9fce473-ae0f-4968-9e9e-5e238f842a57", "indicator--c51fcd1d-21e3-4468-823f-beab17e73c7c", "indicator--9777f07d-4890-4497-a0f7-c24285bf3e86", "indicator--031c5112-2556-4b46-9498-0a6fe721de42", "indicator--d387cdf6-3293-416a-8582-36db8b21c233", "indicator--0340928d-0c57-4b58-bc73-f71d0dbd55a9", "indicator--73f4f800-1d28-456e-b0de-f3c102dc688c", "indicator--92aa6a96-92a7-46c7-88bf-e8ed580f0eee", "indicator--aa3f22c3-7b92-4e8f-86f1-f985b2645094", "indicator--a65343be-c810-456a-a9a3-b4c8b65c5e2e", "indicator--ce3e0aa2-7ed8-4c79-b76b-5247afc2c744", "indicator--9e0945c4-e4d3-4180-a8c0-c304300d8175", "indicator--9e0d70cd-68b2-4d20-ae3d-51d9e2c2e7c4", "indicator--0707adaf-7ffb-4bdd-9a45-5bf99fe489d2", "indicator--ddb52174-8f31-4e88-85e9-780720a35c57", "indicator--ef04743a-5394-40e0-ac8a-b0e0a67dc1d2", "indicator--43f2a8da-8f3a-4e9e-ba36-ced956a63e83", "indicator--9ab2f930-5335-4d56-a530-f6bd749c6157", "indicator--7dc06c59-2b10-4cae-aa86-ad8b6640887e", "indicator--1f9795d2-18ea-46c5-b022-cfa412c64280", "indicator--5a050ed9-abd6-4e8e-9b9d-a650740c2708", "indicator--dcd6fa2b-086f-4b38-9382-cdbc94e9b8bd", "indicator--3aa013f2-e258-4e08-a28f-0693601c49ef", "indicator--75bbd90e-6906-4ffc-8c56-6f076773db52", "indicator--1195b225-5758-46cd-9125-d2d916a842b4", "indicator--62ddcc1b-a7ef-4528-b2a7-16434a127b98", "indicator--eb8e0d5b-bc00-47d9-85f4-b1351b0a5d68", "indicator--ad8bec40-aeb1-4c53-87c6-69003870dc8d", "indicator--f091668e-d31d-49ec-814f-901901b8529e", "indicator--a2a0970a-d224-4823-ab40-8331d24f021d", "indicator--8fd60041-fa77-4c0c-9b9b-d7022a20a911", "indicator--98203c02-5de4-43d7-8638-e8d1215d06e4", "indicator--666d9871-f6cb-438f-9eb8-ef19eff6c1a2", "indicator--bd3c2b7c-ff98-49b6-94e9-1d165db7f8ed", "indicator--41f56526-4f25-462b-b25d-c59785cbe836", "indicator--857736ea-6421-4eaf-8d8a-cee5b00eb0b0", "indicator--6c8eadf8-002b-4967-8dad-4a8f0d51780f", "indicator--9f1de9ac-2a9a-4764-a087-d31bb5e339e2", "indicator--eebd673c-c9d3-45ae-a1b5-f6bf9d4329c3", "indicator--22327f65-ef13-4628-a26a-f5a14484ee22", "indicator--2356eabd-76d7-4504-bc39-4c1ce763988e", "indicator--40f32bb1-bbcf-4b9a-894c-b56648dda3f1", "indicator--e3932dbc-2aeb-4a98-b074-250055612c9b", "indicator--a0dd7164-ceb6-474c-b9fa-e6a01a0e142c", "indicator--c52136f5-3041-45d9-a4e7-9e29bb991520", "indicator--fe7f9451-5da5-40bf-bb24-079a322a7178", "indicator--23f61faa-574a-4b89-a2ab-524deb4c4c21", "indicator--b5c46029-ff85-4d2f-b8d1-091c138f0f60", "indicator--1a686b21-7b65-4c67-99be-a8e58d3506e7", "indicator--3042ac25-3afd-4817-b469-9eecde24583a", "indicator--e5adb9d3-abce-4cb6-9903-ad579a031420", "indicator--4b7e7d1e-47f9-41bc-86c8-31af8430617f", "indicator--eb2b16b4-f612-4bd6-8d14-0432c25c1278", "indicator--617bd813-e87d-4040-9e0d-0ab187301862", "indicator--5062d239-1b49-4e69-bc5f-10165187db9d", "indicator--5a8281e4-1181-4709-a95d-c0fad0b41f8d", "indicator--845af519-3f1d-4b3a-8a7d-45bfcf7be68b", "indicator--40ef53ef-10f4-41cb-92c2-5133340d9925", "indicator--59195254-eefa-407d-916c-f4408372f1b0", "indicator--f8b1e678-9dd5-4b7e-a218-7b066f560074", "indicator--de771ab1-5883-40a8-b6c4-01883a52b9b9", "indicator--1f7b3d57-6343-4589-a573-12bfb33cf7e5", "indicator--080be266-9573-4d1e-9853-7be803fe79af", "indicator--00b8458e-1640-4c37-9c83-ee5f2d6e4b59", "indicator--210a2ec7-86b8-491a-8c44-b9e4673c1d50", "indicator--8297a6cf-83b7-4317-b335-611b96a546ba", "indicator--bd66bbb4-df79-4d59-9823-ff5b53c48457", "indicator--c7ad3989-f1fa-4ff9-aa37-3379c1ab8517", "indicator--8942d043-e59e-4643-b14e-d281c218ad8a", "indicator--1db1ea3d-bc14-4f24-8ae4-e020719018b2", "indicator--0e67d256-c84b-43e6-b9ad-0ca2c2449643", "indicator--3562b61a-cb39-4008-9c53-45ea54d77caa", "indicator--9bb7abc8-7814-4b2e-b0ce-b39a68e683c9", "indicator--689786bc-c6d5-41fe-98bc-fe42060c0cb3", "indicator--59176fd2-0132-4836-9b5e-8f7a2d74b0c9", "indicator--bfed579f-ed95-44df-ab85-916d0e7b5afa", "indicator--5f28c781-a8c4-462c-bbe6-911d51394dca", "indicator--f2b4d420-d4ca-46f7-b794-d5515cde580b", "indicator--dc899e95-48c8-4e49-b566-732ff796be5f", "indicator--f70a6945-8859-4cdb-b646-e1591623541b", "indicator--07e83648-7cc4-47db-9ce3-bfbc5c853821", "indicator--17ce0981-08db-404a-8759-e0c046c20f15", "indicator--5a316ad6-ed0f-4f09-aac9-e2320121399d", "indicator--61a6416f-6122-4147-8086-e0c3a83ca29b", "indicator--4171c310-ba4e-4d4e-8d7e-efdf20526bb2", "indicator--d083f7ab-ddb5-444a-b6b7-57fef18efb6d", "indicator--c5be5cc6-3933-4200-8156-7555e98d1f37", "indicator--cba45feb-5e8d-4ad5-a31d-185d43cca08a", "indicator--dd5baa83-e0e5-4b47-a3c6-982b43b47528", "indicator--d35d2ce1-db0d-490a-b31b-14c13af57b83", "indicator--df40403b-1558-46bf-bde5-fafc4da68358", "indicator--cffc5069-105a-4cb5-af82-95a6a7952343", "indicator--626b70cc-e531-48b5-852e-f26bb5b5e22d", "indicator--a545c9cc-489d-40b2-b239-2f6dc9c45518", "indicator--c5a626a6-e4b4-4668-9bc9-5b1b82b5e166", "indicator--af7929ab-92df-4d46-a9ff-050f4e55fbea", "indicator--e95f7a0f-a7a8-4fdd-bdd2-e7b0bff7b3ed", "indicator--ef0fe9c2-ba22-438b-9d0d-3e5b1142160e", "indicator--f76fb197-2710-4713-b8bb-93b8f7c80aa6", "indicator--a714cd81-d593-4aa3-a8e3-9ac5583e50dc", "indicator--87cfc69f-623d-44ef-8cff-1e1ec6593b6c", "indicator--08d324d9-b00b-4613-9c9d-4d9cc1c87c21", "indicator--ce7e514a-5cdd-435d-afef-00a2e3053c3d", "indicator--21dfc13a-3176-4c18-8a35-e436d917315f", "indicator--0c4c1092-916b-41f6-b6b4-fed3f3dbb8c8", "indicator--57863da2-ee9a-48ff-9072-7ffadc515d25", "indicator--05f6be56-d855-481b-943b-13172868f0dd", "indicator--85c2e5e0-7908-4b15-82dc-736d25aecf7d", "indicator--7586f427-78cd-4234-a220-8e9553e1c830", "indicator--dc29bd98-01fd-4554-8e87-9bad06d5d3a8", "indicator--90487730-0d6e-457f-b763-5eb5c7c50ea4", "indicator--0da489ec-9a0f-4343-8552-2425568f2f5f", "indicator--ff3fa6d4-c1c4-4efa-b574-50acf09b2c0d", "indicator--9dd84300-bac9-4235-b48e-3df14a2b752d", "indicator--3149f54c-4c6e-41b1-828a-05039a0dccc1", "indicator--aa408a2c-36f7-42bb-ad32-d3342318e09b", "indicator--5765d7ad-abd9-47ea-9cf9-5c7b1dc8c211", "indicator--0320727e-b7c5-455f-b14c-73f384496aee", "indicator--12d730c2-3143-4b89-a24f-8d2afcaf8d4c", "indicator--d5055b64-d3ad-4112-aa8b-9e4b9e252a0d", "indicator--8b13b80c-81a5-4023-b56d-f994b5609989", "indicator--768e3a95-05cb-4b13-8945-b2f5c7b7e26c", "indicator--28457579-b712-42d7-9ca6-13f9b892cb0c", "indicator--71f27194-99b0-416f-bb75-9dd50042be52", "indicator--e166e2b3-5ba1-4a75-a825-8d8e67be2dea", "indicator--acd4dee0-53dc-43e5-8740-705060e66ce1", "indicator--c27cb55f-6f25-4f16-8bce-bec5a55e4958", "indicator--e932b933-b9b2-4aa4-812b-8642979e3854", "relationship--d4db5634-c008-4bf2-bf06-b94285c9e396", "relationship--f623923b-18e5-4b22-afdb-b6e524104d70", "relationship--4360322a-a906-4542-bddb-6f85c97bade0", "indicator--dee130d3-48f1-450a-a477-aafcbe50be2d", "indicator--a913b7c4-0c34-4c14-a86b-7790d0e15f56", "indicator--4e445dab-f547-46d7-b3f6-4f6a93702ddd", "indicator--088a03aa-a9b3-443c-8920-a95615be6506", "indicator--4239260a-bb41-46c3-bbfc-b2c160e726e8", "indicator--6f8ae848-ddaa-4681-bebc-420b5e95e698", "indicator--9fd34725-6b85-4522-9465-c153156eb39a", "indicator--5b9abe7a-3690-41fe-ad38-5d1553c9edb4", "indicator--037042dc-d32b-4417-ae11-20c5ce963faf", "indicator--b6c0c839-f757-4072-bbbf-4e31babc63a6", "indicator--85338d16-c011-4dbc-ad51-7829350fb35e", "indicator--1e3d5919-07c7-40ae-a3aa-6fa72d411bd0", "indicator--bdc700b0-bfe5-448e-8f0d-c67d79e6fc01", "indicator--dac0d3da-a697-4caa-bb06-b54945bcd2f2", "indicator--d9204abe-214a-4adc-8be2-05003d0b1449", "indicator--435cbf36-5930-48bf-bfcd-2215d3f384dd", "indicator--cb971eb5-a8f9-4b1c-96fa-4e5b13698828", "indicator--4ba180d2-b971-4789-aeb9-37a7f665e06d", "indicator--f0cc8f4f-b190-4812-ab70-3d77b586dfe9", "indicator--9c95fb2c-5c79-41e9-b0b5-aeea63a600c7", "indicator--f5489751-4458-4612-adb2-2116d49e439f", "indicator--67054db1-588c-4c90-bb90-7c32e4404fb0", "indicator--15e7badb-0207-48d7-83a8-00791e1463cd", "indicator--f530e278-016c-41c5-a36b-70f61860a478", "indicator--81b2b08f-3f8d-4aa2-a9de-7f01400f1d1f", "indicator--70ca799c-04c2-419c-8869-cb29e3632ba8", "indicator--4ca939e4-89ad-4f2f-b2b9-7fa54b8da350", "indicator--6a558943-aec0-4270-8d41-3da8097260bb", "indicator--ffe33437-e5f1-4c34-8a98-7348960f5d17", "indicator--0e22d683-f940-4fea-9e3d-d7238ccc1165", "indicator--dda5d525-a9a4-4c1b-b875-df8a64886b48", "indicator--9e9cd7e9-1b9f-4d8a-afdd-9fb43f20c74a", "indicator--aaa90969-e849-4062-b4f8-d3a2062d7b3b", "indicator--6d0a9582-647b-4f0b-873b-5816ff14ab90", "indicator--7121743c-ae52-402b-a254-de1357b1976d", "indicator--991c9561-64d0-4dd0-9d22-06ea682eba12", "indicator--8bfadf2e-7a70-4396-ad48-568a51934632", "indicator--51194a47-870f-4cc4-98f1-6129c59e5f5c", "indicator--7b648e72-c5a2-41b1-a626-e3ae41409a37", "indicator--160fe854-ef4d-4e4b-bb57-7ba3ae210db0", "indicator--a19ef107-725b-442f-8d2e-339476f693cc", "indicator--6619a21d-be2f-4889-a635-3961a89eab61", "indicator--b8d3a40f-1be0-4d9e-ba2f-919cd9bbc315", "indicator--18f815d6-24d1-440f-942a-6b5f93401a90", "indicator--7d6f5185-14cf-4549-b149-5a6519988667", "indicator--fe0a11ca-f414-4db1-bd31-e64b4b1eceb2", "indicator--638e18c0-ee1c-4648-a722-08b673ae20da", "indicator--248e2b31-428f-4804-9dfd-4d565b4f7a14", "indicator--d0bf6a60-52a5-4a63-aa5d-a7ab134d7645", "indicator--46fc28fb-c75c-4c43-8ea4-42de96e4bd57", "indicator--8b07ec2b-7462-48fa-9e5a-0689d402f204", "indicator--2255feaf-04d3-4718-a182-e55c1af5836a", "indicator--38f3562d-baed-4a22-9358-0174c5ce0359", "indicator--38548828-c55d-422e-bf5f-0c6ed93bfacc", "indicator--359eb519-72cd-4f8f-a1e5-547a2cedf3f3", "indicator--befbece9-1fa8-422c-8122-9dd701ebd9e5", "indicator--6abceb3f-7cac-4660-8e89-7308b7322f9d", "indicator--9e014b49-a66d-408b-8c18-e76fd47884e7", "indicator--faecbe12-ffdd-425c-9885-eaab57f4370c", "indicator--c506cca1-e376-4f49-8833-e6b7ad8e17ed", "indicator--4c95c8e9-5a98-45c0-bf58-e1d14fe3ce7f", "indicator--c08a7bdf-97c9-429e-b17c-7705b6aec8e7", "indicator--937acbc9-d0b8-41ff-adde-75f70bdcc1ab", "indicator--63e780fd-67a9-49a2-8246-6edaf7a77df2", "indicator--83b947b7-297f-4f99-bc73-d28d4b494283", "indicator--58115340-7153-4a00-a0ea-75ae9e005a90", "indicator--e5fd3c05-a50d-45c1-b49c-cac5eb820c8a", "indicator--0ced7de4-40b3-456b-ba07-f29169292147", "indicator--31590592-4655-4bb6-819b-df5a5431e299", "indicator--4bcdc611-a5e7-446c-8555-64a522123389", "indicator--36bfc9e7-3ad2-4aef-a2f3-732df8441d37", "indicator--2498919b-ab4e-45c4-97a8-38e62fd8a867", "indicator--ea3de3a7-ef06-4398-8593-0786d46cc819", "indicator--36d60857-1a45-4b2f-bc5a-9a56b52ec5e0", "indicator--1aa4a7f5-8e22-452d-9e3f-dab532a4513d", "indicator--4a082e88-93e4-4ed8-8b79-3312e3864f4a", "indicator--bbaee239-96cc-4bac-a4a5-d7cb08cdf862", "indicator--f93c98f3-5669-44d5-939b-7a2f288f5a78", "indicator--ba4c1e9c-1ec3-4b54-be0f-49182d4514a7", "indicator--be2ee3a0-21cb-4962-a94a-6b28a358fde4", "indicator--6675bef3-b76f-41c8-8f52-52d3ebb6d2a9", "indicator--f73d0e9b-21a1-43b1-ba0e-271be2af2e39", "indicator--4cc29e7d-b7d5-4561-9d1a-c85284a5b4d9", "indicator--e8385e48-6136-410c-b46e-74fd915be934", "indicator--405a3fdb-da19-49c8-96b8-b72f19b7bc2f", "indicator--4134b78c-8cfc-4902-a65e-d12fea723da2", "indicator--d5d3d356-6f56-4a71-970c-d79cfb63d012", "indicator--f5ac7442-636d-457f-8829-9bc2d8931738", "indicator--2e30dceb-0ec7-4bce-9917-15a06c1b4afc", "indicator--363d9e33-e558-4b06-a198-867e31ebb2b0", "indicator--424aced8-fff3-42ea-a784-296f7475bbcb", "indicator--90c900cb-0bb7-44a0-a755-b5e555e5a9b4", "indicator--364a3ef7-8658-46e2-9049-b23b71222b79", "indicator--d1f8b958-8219-47ec-a9ed-a5c57fa6d77d", "indicator--19ac8795-b6b8-45c3-a4cb-3c76b18b7bd6", "indicator--108ca67c-8223-487d-8410-1b35932fb781", "indicator--40608dcf-79d8-40a0-a8b8-b2908e17adca", "indicator--1b616778-2726-468f-a2cf-247c5501453d", "indicator--c9e263d4-6fc8-40bd-8ebd-be8a6ccef5f9", "indicator--bf5b9f91-d952-4b60-aa5d-b391594e055a", "indicator--cef746fb-753b-43a5-b615-0c3789a9e28e", "indicator--193ebe8a-f75a-4589-a9fa-bd63238935dc", "indicator--eeb2539f-1227-45a1-b849-4e5bb4191fac", "indicator--9711f71b-c480-49f9-a21d-d303591ec41d", "indicator--e59be5c0-736a-498b-862e-b7350a601df5", "indicator--8484ea66-3a91-4a1f-92f8-83e1698f157b", "indicator--c105c2ee-63bd-4949-aec9-fd486a6984a5", "indicator--84fde415-3b31-4e4c-9fe1-c1808447c3f6", "indicator--734be533-8b08-4fbc-81ec-d64490afd6ce", "indicator--2a8a86f7-951f-4bd2-8d3e-b4cb35dffd50", "indicator--7349321f-5076-437e-8299-e7304a165e5a", "indicator--6ce2f7dc-2253-4748-b451-461171c74bbc", "indicator--d63aefb0-b9af-4b86-aeb8-2e7904b2d048", "indicator--bb3aff59-bd80-405b-ac85-d9cca1935bc2", "indicator--2a61186e-6dbd-4959-98b2-393505aacbf1", "indicator--d8699f46-5d00-4e38-9e37-005843504999", "indicator--668ce408-3f31-4b51-9f33-90a350c3ab95", "indicator--701cc2d8-46e9-4492-8195-c0777c481637", "indicator--8239b483-0b5e-43f6-a4d3-51127760834f", "indicator--004eddbb-cadb-4540-9c24-37f307bfc00a", "indicator--49e4d686-a8fa-4a55-9479-b90c997c2ec8", "indicator--561fbb22-6822-4458-998f-aff48b30f09b", "indicator--1d84fe07-9452-414f-bce1-f9eb621ec7ab", "indicator--9cd81d15-d53b-492e-8263-908796597b8e", "indicator--a47d7b83-09aa-4b44-8354-360df039f893", "indicator--a23c24d9-c7bb-41b6-b7b1-0447f8200408", "indicator--bc17b749-b476-42ff-9227-da70bba62cf6", "indicator--b2bf94a4-e0a1-49d8-82e2-bf59fa5e67b4", "indicator--6a55432f-fd41-4f1e-b70f-56d690088c70", "indicator--f3c766ce-6598-4b48-93ae-44c93863eca2", "indicator--ca451171-9405-420b-994f-8270f494b6a3", "indicator--39c9cf3e-824b-4adb-bc30-f5523637109e", "indicator--7453a716-7849-4ee1-9e50-56aa9d3de450", "indicator--621bee9e-0ce2-4cb3-bbc0-eecfb4320d4a", "indicator--2e5d4134-8b32-49df-8683-ac4a64c44b6f", "indicator--0dc61a80-cd52-4a2d-8cf5-a3734677344c", "indicator--7144dd3a-9edd-4994-b324-58ad7f940f40", "indicator--4585a5a6-e124-4bea-a10a-e61ee39da716", "indicator--bb3abfee-4871-4216-8dee-69cd31a39b1d", "indicator--f794664a-27bb-43f5-b8d2-e351b994e3d4", "indicator--8ed8f485-ff88-4f2e-8cbe-cafc4bcbcbb5", "indicator--b87f7381-c171-4dd7-928e-7ef11c0646a5", "indicator--ad3755fb-1476-4916-a7e6-5038e2253cca", "indicator--06f3ab76-9eae-4da6-ad7e-33fb6ba44b40", "indicator--e2bfe14e-7dbd-4081-b1df-653a0e18cd3a", "indicator--0daede3e-973b-404e-8825-401f87753a15", "indicator--c0add56f-63dd-4176-992e-922a3e25a641", "indicator--dabb45ea-4bd8-4da4-86df-15cc63cf480d", "indicator--1bbc3e98-cd23-4aeb-98fb-a1bd70e12bc4", "indicator--4c29985d-f5c7-4f5c-bf08-657ed60a37e9", "indicator--c6625cbf-01cd-49ec-9710-a5c1498da10c", "indicator--79067779-a6d5-4899-a8a5-1cd618b11c9f", "indicator--62a8934d-1107-4982-90d6-532a5d376974", "indicator--0c2db9e5-7978-42fe-a84b-b16f325b6084", "indicator--05a250ca-9b02-4337-994b-fc88cc3ea0c8", "indicator--5e520fb4-3b74-4603-a5a0-057a410b5515", "indicator--6ea11955-5351-4455-a15d-79c4dfab6802", "indicator--fd3bd8b8-7062-46c1-b61d-0820b69111c2", "indicator--de877be8-4875-44ff-81e2-db5ca87a0769", "indicator--379ed1c3-7238-45e2-9620-395cfb4bed94", "indicator--248bdddb-4f10-4eb4-836d-a1fb48012add", "indicator--1151ae9c-d991-4d45-9f50-7fb5eecc5157", "indicator--f0fc1a27-eca9-4f02-a565-da6f33eb58e2", "indicator--2edd4668-8d89-4952-8215-05a49e03153c", "indicator--b7d5e1d4-acb0-48dd-8ff6-cada346cc81b", "indicator--3119782d-7dd7-4bfe-b0cd-1c095eb46d89", "indicator--c5206e61-783e-4cf8-85e7-134b7175c90a", "indicator--63856ff8-6891-4409-9719-7ff21de12990", "indicator--5f48158e-32fd-460e-b353-5534d748f421", "indicator--6d8db146-135d-42a9-b3c9-7837f465e497", "indicator--7b144f71-b958-497b-b9b9-4f0fdcec9592", "indicator--6dbd50d6-c060-4598-bcce-4081983d9dc5", "indicator--fbdab16d-7191-4bd3-9705-c328c4581f3e", "indicator--6122088f-cd6b-43f9-9ce6-4c814a935fcf", "indicator--a6314e30-a5e5-4f21-9e4c-63c38e1a5099", "indicator--cea3e976-2d2b-46e9-8db5-a52c75a830b1", "indicator--84441d84-035b-4cf2-9db7-045e469e200d", "indicator--30a70876-c204-4bff-acf0-86f84444b7be", "indicator--82f86c85-3515-4214-9450-116310425f0d", "indicator--ca497608-92e9-4a8a-9309-0b4195482d77", "indicator--376c81ba-7e04-47ca-be45-28c1db5c030c", "indicator--8f917cae-8003-4f3d-8320-0326919006f2", "indicator--e67861db-77d6-4394-9329-ff3902f1e523", "indicator--498bb480-bb22-401b-8aa3-0ba5402436d4", "indicator--d92a29d4-9216-4c7c-9f41-cc5492f0ae11", "indicator--361424de-b01a-4709-8c60-422bc6ec80d3", "indicator--5346fbbb-8244-4e6e-95fa-f6bc49372bc8", "indicator--e2e1a20d-4b10-4f24-a59c-ca1b58034f54", "indicator--f7a1c976-ca3a-40cc-8d84-feab7f3bafdc", "indicator--da75402d-6059-403f-b82c-831110076486", "indicator--60280e95-b1f1-4a5f-b0d2-c5cdad8ae99b", "indicator--8a13f601-08bb-4eb5-a1f4-854643006656", "indicator--8e30265b-d0e1-4774-b571-e871fdd63efb", "indicator--1619b851-dd71-4da1-9984-ba685df4c852", "indicator--d3c94072-7307-45c5-be6a-e91e327fc7ba", "indicator--2ef0b579-9b07-4ca6-9d8e-728385a200b0", "indicator--e8bc6ec3-8af2-4866-8900-168a95d23959", "indicator--acc22f26-66e4-4181-9801-309f3713595e", "indicator--d58b29bc-6965-41f7-8505-797f0300dc0c", "indicator--0d313e38-dbc4-4455-ade2-a6fe0b89dc27", "indicator--468ff3b2-e62b-4bca-9e54-cd7b1625726a", "indicator--8dc6840b-ae19-4a6c-97ee-b6d06a0b471c", "indicator--f52e900b-6680-41d2-9768-7b430da5b7c9", "indicator--e031290f-3c3b-448e-838d-4379a1d50055", "indicator--8e41865c-a5de-43a6-a2a5-f6a4b4e3e800", "indicator--67b040e2-914b-4dce-bc02-aa9e971a06f2", "indicator--9befccbf-7a37-40e9-be16-956f878a28cb", "indicator--bd83bc35-2887-45b0-8836-3706ab799100", "indicator--79451dd5-4262-494a-ad83-5ec52faf2f7a", "relationship--bfaf5e67-a07b-44b2-8e78-fbd044fe0deb", "relationship--47900d45-9117-40de-8080-115cb510cca0", "indicator--40b1072b-3d31-4235-a716-a3f579ccc5f1", "indicator--a1fb177c-595f-4057-b2f6-382d85784f84", "indicator--6a4c0d3b-b94a-44b0-81de-cab5ffb0df42", "indicator--9bfc7a84-65cf-4010-aafb-7c66b172a8dd", "indicator--06f00a74-0a38-46e1-98ee-bca46e26e0e4", "indicator--5ab8a7f4-dd66-418c-bcf2-6f1041b9d8ae", "indicator--b9943578-2785-4968-b93f-0eae7a28d205", "indicator--b8b20f5d-1b80-4562-90d4-f8a35f01fdab", "indicator--383da508-036f-4413-8e70-358e1528dcbd", "indicator--6eb63c89-4817-4f1e-95b2-0d4ea40c99aa", "indicator--43645cd2-26c4-4480-a521-d4e7a70cbf80", "indicator--2325bbbc-2559-4717-a5ce-48f465689e11", "indicator--dc441bdb-4a9d-4ab8-9254-970c5e29c774", "indicator--5e26f48f-6b0b-4e29-9e42-ff0119f02c3f", "indicator--d212030d-19d1-43d8-9a39-f271e4b70ecf", "indicator--52f7c1ad-155f-4742-be10-923c5ff47e43", "indicator--c3b44b54-8851-4217-8944-abee20464258", "indicator--fd369a26-513d-4674-8452-a6bb228078b0", "indicator--73a15ef9-45cd-40fd-992f-1278698433de", "indicator--1a7d526a-1992-4b14-b7a3-a405b8f6f5ed", "indicator--412f1ddd-90cb-4c1b-8ce0-eb5b7fe070e3", "indicator--180d0d92-1070-4d6a-bb38-b80e62244904", "indicator--0594b9e9-3f66-47ed-ae82-09424536aa4c", "indicator--d071bc92-2875-4c7f-8da1-4f0ee948855a", "indicator--7b68fa61-5851-492e-aebd-d38f81b19373", "indicator--da3b9aae-6e59-41fb-b825-b29517aab2e1", "indicator--d35f49db-74c7-4826-b6cb-1749d2f2f3c7", "indicator--8df438be-0947-4c2d-8375-085d4876a180", "relationship--a456ca0e-687a-48b7-a42f-639be0f596a9", "relationship--31d02f2e-b29b-4597-bb83-3e648437d75e", "relationship--703fbb5d-6efd-466f-b988-6096e8634038", "indicator--088fcff9-5076-4111-b829-388e808fc1a2", "indicator--51de0aec-0de3-4731-a6a3-e765d96c7852", "indicator--032edd92-a99d-45de-b989-1bb6891fae0b", "indicator--83c383f4-c292-43e8-a910-baa955b3da21", "indicator--fde97338-041f-4a10-ba56-d435d73217c9", "indicator--138ef7a5-e2d2-46b7-94cc-c5fee8005f83", "indicator--7daf85d0-d6d8-40ad-b252-e0df6db307d3", "indicator--c6f22aca-f146-4033-84e9-ebc50824372d", "indicator--caf77a4e-6879-4c9f-89e2-1467ded11087", "indicator--e06886a0-4df8-421c-9f78-858cf7ec91e8", "indicator--c55b373f-e867-4d75-b684-75dd812999f4", "indicator--abcb4e5c-c7a2-4105-b372-2e587a49a377", "indicator--20faefbe-bfa2-402a-8a0e-4f61f5259214", "relationship--85a1a9a6-4e06-46ce-be2d-5fd7bd44e1f2", "relationship--36dedce3-4da0-4698-862e-8253f15b3d34", "indicator--d721dabb-1227-4916-98cb-65ebc9c74e76", "indicator--1b42bbab-4a5a-4fe0-b833-29648af1bc0f", "indicator--dd02ea54-ba3c-4959-a215-da9ba9f752ad", "indicator--3f922b12-dae1-41f8-987f-cf5b5211df6c", "indicator--cb3f0a93-fd0b-4085-8e69-b44a2b9d5395", "indicator--6fe793ca-1ae1-42b7-ae3c-a4378c48ead0", "relationship--b7c39ae6-2668-49e3-b5fa-6205de92373b", "indicator--5cf5c209-8967-40a4-a424-1148dd678248", "indicator--e76b432f-14d4-4dfd-a4b4-0c3cb96133ee", "indicator--66c6ff27-889c-4fa9-bced-84617103f6fb", "relationship--48323f8f-2b11-47c7-a456-d2477c7e56f3", "indicator--6dc4c0ec-c862-465a-b12f-c72a779de191", "relationship--a3e7985c-b620-450c-8558-279b039bcd0f", "relationship--d7f9b421-acf1-4aa5-80f1-de0316daa7b0", "relationship--e6c6ae70-90e4-407c-ba7f-6703b1a21e28", "relationship--e024b7fb-3635-40ad-a71a-3876224aa4d6", "indicator--dd67f241-6fbf-41cb-ae87-481a8c46067d", "relationship--146a71fa-bd93-4ddd-acc0-ab8b54d10bd5", "relationship--e49eddc4-7a1d-40d6-b7d6-0322613a455a", "relationship--e31fb93f-b3ea-4534-8d0c-be13c11ff8a0", "relationship--3dd8e2ef-d03b-426c-84a0-313997412628", "relationship--021599c2-b54b-4000-9326-4c643ae3b761", "indicator--05de1c07-e593-4a9c-866b-2e6b8b71cc0b", "relationship--877cba83-26ae-4171-a2fa-e092cdd39741", "relationship--88df6221-1a42-446f-8883-fc32c6abb7ae", "relationship--1f93ecc2-c148-4d31-9a8d-5f93bf6d4d93", "relationship--ea7c4447-1316-4835-ab72-58d8b7a57308", "indicator--343448e7-1d13-4a2f-9f6a-3a21f20d97af", "relationship--fcf5ffad-ed78-4e64-805a-7de3e16eb143", "relationship--79b8b322-7c4b-4855-9301-8e38ee70a17a", "indicator--4a304aa9-fcf1-4a87-b927-8fbded783aea", "relationship--8b67d63d-fda6-4938-9ff7-b135762e3eb1", "relationship--ed858e57-2d82-4feb-b4cc-ed5657fe8fd5", "indicator--556df774-2197-4290-9fe1-adb6750593a2", "relationship--8bee356d-85eb-44a2-9f36-e1da5316f733", "relationship--468e7d7c-9452-4729-8604-c909e7bcce83", "relationship--57568de5-4812-419d-91b2-f6cf02976130", "relationship--eb017876-a1c7-455e-a619-8fc4a8ccc6a6", "indicator--d850cde9-2a99-4277-b2a6-6e55c65364c6", "relationship--b5806aa3-a72a-4018-877b-baded1b7c9cf", "relationship--8e156018-5e0f-4d80-9bb2-69fd092455a7", "relationship--947a9184-f452-4a23-8a91-f3056b9de36c", "relationship--51939ba2-c0b6-49eb-9505-37a37a80ced3", "relationship--402a828e-3c54-4240-ac95-1380100b69d7", "indicator--eb8ed431-647d-47c7-b726-618492cb555a", "relationship--174cc6a3-5b8e-49bb-a567-f095d8eef145", "relationship--63a43f96-6029-467b-aaea-c8aa332a5502", "relationship--0ea006f6-9e0c-466f-ad08-696cbf387eaf", "relationship--05c86238-d5e1-46d9-ba87-638b62806c58", "relationship--6baf3744-5ae5-4096-b453-9d1b5d1a5c2d", "indicator--6a64e767-2b58-479c-a158-aeb505715aaa", "relationship--719925ea-047f-4cef-ab53-8872977c1a67", "relationship--17b8a11f-7d1b-4ef3-a8e2-73bacf0285f0", "relationship--9c168d18-f3a3-4b0f-9f2b-8d0b2e6c00ef", "relationship--6f668672-5e3d-492a-8bd5-224dbe892734", "relationship--fd26a38a-efb1-42ad-8ef9-34b9ca8dbdb7", "relationship--f8343fb8-d0d5-44c3-a04b-08058147da91", "indicator--69cc8ced-e61c-412b-9dfd-aa9845a1e040", "relationship--73513656-4018-4a19-a227-cf47f561b642", "relationship--0910592a-6264-4b75-b311-4ec95e23e6b3", "relationship--ef5f29e7-a997-4ad9-9bd2-535e8fbf248c", "relationship--fd5d2bc5-ed88-4e05-991d-e0e8ffb90788", "indicator--e67a8cce-2891-4116-8b04-22c766653092", "relationship--236df2dc-5855-4135-8b02-25ec32745603", "relationship--2acc5ecd-47bb-43fc-8e79-e3f64e224337", "relationship--459acf77-3638-435f-9c43-01c3bb159a8a", "relationship--ca4bc233-d8d2-45de-8eec-4623fd91962c", "indicator--faec65d0-dd3b-4dbf-b09a-93bd5ddadabd", "relationship--8a7e3c69-a05b-4524-9ea7-c00f832d046a", "relationship--784b5cf3-662e-4955-86cf-1d1ff9301e03", "relationship--0f97d8dd-7fac-482a-a663-8fcc5c4c2322", "relationship--84cc36a3-e5f6-4ed1-8d2d-6c6958e15114", "indicator--f380cfa8-6c1f-45d2-89fd-19b241f96599", "relationship--3071023e-6cef-4e22-bad7-63ac9594bc73", "relationship--adbef5a7-af43-4799-a31e-3794b5c00f68", "relationship--ddb63bae-eb2f-430b-b7f9-1fd988e49177", "relationship--3e557aa5-7e2b-4919-97f7-8ea3c555ba07", "relationship--7075bb61-eb40-4e79-8b60-f31cbee6f964", "relationship--3087a2dc-ae95-4fdd-9599-047608a1dc62", "indicator--e1862c5b-2451-406a-bcfe-eead9df5cd15", "relationship--92469197-5f96-4784-a32b-e7ea70f76e18", "relationship--ce866ebb-074c-46fc-a5c8-9dfc8c829338", "relationship--77bc36e6-3097-415a-9056-3179f9b4c9e8", "relationship--8e0ccbdf-5385-4f01-9703-d4f5dd170316", "indicator--7b36f731-067a-418e-b664-cc5a8cb7fd84", "relationship--62a06a0b-5480-4d2c-824a-40a79fa8eae7", "relationship--7ffddf8b-95b4-489e-9bf4-b40e26d72afd", "relationship--f376caee-4c3f-4a83-8633-cfa2cb6d9fab", "relationship--af6c7edf-a3a1-4d83-8d4f-4925ef6c03fd", "indicator--1f1e35bc-1cf7-467e-aa75-86e0c7bff895", "relationship--8217ff1f-4d0c-443a-8018-c6a5cb3021aa", "relationship--d2656ca0-70f1-4205-981b-aa2c9de28ebe", "relationship--8006546b-0423-4617-8029-8e8a9085f96b", "relationship--c2cb73fe-68b3-41a1-be56-f1505f72b486", "indicator--cce3079a-7aee-45fe-930b-b1717ce5c4ef", "relationship--bff1097e-4221-4352-9a82-39f269c1829f", "relationship--680b25c8-977a-4461-88a7-a6d4e70a2f66", "relationship--cd607f8b-1da2-4147-9e82-e4eab23e3986", "relationship--f2b8489c-d893-4d9e-ae4e-a63b90461d7d", "relationship--bee5d1b2-fd11-47fd-87df-ad3bb21aee5f", "indicator--9b6bbb45-8a26-4039-ad56-980ecd9c7dd3", "relationship--4ecb0aee-31fa-462f-a66e-f0bdb8c27030", "relationship--282fb25b-8f2e-4dfc-9efe-b4b4046fd469", "relationship--ebfcfa38-d38c-46e7-b991-648a71fc47c6", "relationship--1370adfa-199a-4f4b-926b-555608728dda", "indicator--650adda1-371c-44ee-aec0-6be04367af01", "relationship--262eaa16-eb28-46c5-827c-c54600bfdd68", "relationship--b3c32094-9101-40b6-94ad-fb3f1be9df0e", "relationship--25b13690-5c85-4002-8415-d939287473ec", "relationship--adaee552-bd46-4d9a-894a-8b0ad9d3d70e", "indicator--2ccf453e-6d68-4940-94b6-c8d954331932", "relationship--d56762fa-6c1e-4c16-8875-b6d47801bce3", "relationship--f766333f-ac2b-4ad0-9132-6bb3d8918773", "relationship--4bddeaef-a329-460f-8a93-b59e56c86a65", "relationship--622c661e-ba88-42fc-a93d-bae067c6e532", "indicator--e6513bc5-de0d-4099-a5d3-5dcedbc188d9", "relationship--1295545e-3aa7-401b-8728-0abf59ee912c", "relationship--5be05c67-b693-4e21-a481-9cc9897e91dd", "relationship--d33b9474-1567-4593-8bc5-89037a4c2977", "relationship--8f0982a3-2aaf-4c91-bd76-0270214d09d9", "indicator--f8f4c0a2-a2cd-4191-98bb-f95cfae3652a", "relationship--06d7d4ea-5bae-45a7-8448-0d8819a17ebf", "relationship--413b401b-a74e-4130-9b0a-03ab690d300b", "relationship--6ec7f758-42ca-4d3a-a5b3-7ba4e0df44b8", "relationship--4884bf8f-2432-4224-b391-6c8425498187", "indicator--63331dc1-38cb-4e88-86c1-13f921e8b02a", "indicator--73810339-f8c4-4aec-98b5-acd6f28e6bdc", "indicator--abcf17bf-5152-4250-a66f-5860489cd72d", "relationship--f41be977-fd59-4006-9b47-41b03fd35f44", "relationship--23f12edb-9a25-4fba-b540-5609f0967624", "relationship--ad5ce8b1-1df5-4b2a-a9c6-c4e6a4cbb005", "relationship--894d30de-716e-4f81-8f36-5d20ccd65e4b", "indicator--1e56977d-81a6-4655-b5c3-0b07ca513de6", "indicator--dc8c3bbf-9119-4c37-b590-26c44b72b5bc", "indicator--498610ab-706f-43cd-8a72-eae14a2170d4", "indicator--1bdee8f4-57c4-48ad-8de7-5be074311a0a", "indicator--0bee43a0-41ff-480f-b0a8-a3bd684d6b82", "relationship--0f392e4d-b106-4368-8cae-b721b973a253", "indicator--ca00b4ec-7827-4c36-8c4c-f2d0f74b63c4", "indicator--277fa4e7-c13f-4df7-ae14-734f123da708", "indicator--e5ddc0a9-ee73-41a5-a2f6-c67ae44f6bf3", "indicator--622c7fb5-e56d-448a-94eb-48e78fec10f6", "indicator--72d29f14-bc28-4b05-b6e6-34769a6b1bbf", "indicator--106fa3c8-a5b7-4d29-82db-5c8f590540df", "indicator--e5fb6ccf-aee3-4d06-8136-b41837c3adb8", "indicator--f81fce22-f244-496d-bfbd-76d01b467e94", "indicator--99532b6d-fc4e-4563-a58f-622d3a5e4d83", "indicator--0ed42bff-a5cd-4cb8-82d2-1c7de8a1365d", "indicator--b2127ffd-6d4e-412f-bb73-8d4c35506299", "indicator--2521b0b6-cd78-4ad7-89c4-94ced849abc9", "indicator--13af3df7-97ca-426b-927a-37fa3a2d072f", "indicator--88e190e2-d734-4a1a-a97e-543be371f6f4", "indicator--660b1b9c-5df2-4f7c-9ba9-423caca34268", "indicator--f066c6ac-0501-4b05-8a7c-0e32e4efe7e2", "indicator--05bb6ad3-dfda-416b-9626-b5d4894726d5", "indicator--552ea42b-da46-4a9b-bcb8-49e858042f7d", "indicator--d170d332-a6ab-4b5a-bcce-49f398d5566b", "indicator--3302c103-5a5c-4ee0-9971-aa6ce3128ad0", "indicator--3c3e75d4-757c-4007-8cee-6a63c6a52b03", "indicator--bb647e89-f1b6-4a31-8558-eb673d75f7b1", "indicator--697b9932-b52e-4cd3-8529-8c99c4c4fa04", "indicator--fc8977d0-ca93-405e-b2e6-24b809f43d85", "indicator--5e906413-5203-480f-a604-a6830373fc72", "indicator--cdce0a57-a5b3-4cb7-9568-a51d0e8bdd35", "indicator--8c497e01-ed23-47a7-ae74-60b4f2d9dd83", "indicator--536f435c-c1eb-4475-9512-7e0d06f594f2", "indicator--53a7a0e0-6c17-47f7-bea5-1c804e905606", "indicator--2acd8dfb-16e3-4020-a22b-ee588fe5438e", "indicator--5623e5a2-88c0-4a1d-a821-e9ea271f93e1", "indicator--40891bf3-83a3-4105-a5a4-dbd82da25ba5", "indicator--15e960e7-0824-4f2a-ba22-fe7918f116fe", "indicator--80550142-8236-4424-b216-a4fdb0a35175", "indicator--f4db7eda-56d2-41f0-883c-891ca0a8b214", "indicator--a229dbab-bec2-49f6-be66-810b0ffdf840", "indicator--30dda65a-3aa2-4d34-8770-4beb4f61244d", "indicator--ea725af6-6b2b-46ef-842a-f98acb31329f", "indicator--6c586095-6c12-4639-aa41-b57a0f4e6614", "indicator--23821cb3-0eab-4a77-939f-5bc2336611e2", "indicator--dd4466b7-ed85-47ea-a0d8-b0ff78329196", "indicator--b77c0f75-0744-4047-bd34-bd67d04b046b", "indicator--afa6fe42-28f2-4757-ba95-26b086274208", "indicator--d62a0138-8286-4a03-aa13-5c9588c079aa", "indicator--4b5ac460-a081-45d9-bcc2-3cf2365ff6d1", "indicator--8030b229-bd78-4181-8d82-0d6051b740ff", "indicator--0ae4c81b-2657-4fbd-a2a1-68368cbe2455", "indicator--842c529c-5de0-4765-a54b-812745e66526", "indicator--bd70cfb3-0aab-4bae-be16-8d7292c61aef", "indicator--36d3416d-6e6f-4c37-8881-8153fe3a6021", "indicator--cacf7d86-ad53-4276-b168-224930b0fc74", "indicator--5397e75b-83fc-4f29-94a9-56ee804d758e", "indicator--be898d3d-d71b-4266-9942-7188caba2f00", "indicator--711fa530-4d7c-4443-a9e1-517e01a647c8", "indicator--de7102fc-3025-471a-bbb6-7aedc49e9e60", "indicator--47db25bb-6590-4795-bf1d-f9663533d978", "indicator--9ad5e872-93f5-455c-9af5-c9cf57494abc", "indicator--8a3d7a54-bfd0-46b1-9c57-4320233963ca", "indicator--10f5eb59-393c-4d83-88d5-8327467a37aa", "indicator--34388293-a717-4efe-8f43-a486b397d41c", "indicator--5dc5e19f-f09a-42fa-9f90-3b8bd6fb11c1", "indicator--cd265600-20ef-4a90-9a13-9e0ab3394db1", "indicator--73d56358-051c-4cd6-a76e-f3df4c2abf80", "indicator--b4e2e13b-94fc-4f52-9cf6-dc039499db70", "indicator--81011f94-0fe8-4d92-80c9-8728c95971d1", "indicator--616dfacc-1d05-435e-a54c-c40bb348a488", "indicator--f17163d1-8536-42d9-b7bf-5c1ffdfdbd2e", "indicator--8e6fbb68-2f3e-4ab5-bc5d-3a38b341befb", "indicator--f0c224b8-ca60-4b80-9aac-9af9599c2c7b", "indicator--15f18ee1-d49b-4c9f-8514-81ffe1595a20", "indicator--b49486ff-a8a6-4940-9c27-12c3b1326f9d", "indicator--e6832276-38ad-4548-960e-0abb04fe3c7a", "indicator--b63fa6f6-de23-4a72-ab45-c24a3d52189a", "indicator--c0c8657d-8cef-4163-8920-30fb797961c8", "indicator--6fb3dd51-4e9b-4501-882c-13128328129d", "indicator--74a1faa1-3948-4659-b044-9776f6b7922a", "indicator--4f24cb4d-4bba-48e6-b27a-2daab81f72f3", "indicator--a02703a0-f795-4025-8ada-220517ec0dd6", "indicator--66df543a-8dd3-4523-9706-f2c4b3c88a5a", "indicator--d6028bff-2880-4abc-b13f-df42a26e0859", "indicator--36642815-8f1c-43f2-9a23-70718deecd19", "indicator--45e41707-8229-4143-8617-5e46369f8f35", "indicator--723342a5-7288-48dd-8f8b-c937b0c2f628", "indicator--d8dea7e5-5f6e-447a-8e17-1c532ca07e38", "indicator--f3421831-43f0-4e80-addc-8a05f27469ac", "indicator--9a963dcb-9971-4265-b6e5-419f2101eb9e", "indicator--cfbf480e-5d59-4379-80db-f92e5157e34d", "indicator--935aeaa7-aacf-414b-a113-1122bc80d7e7", "indicator--4ab54784-0566-4f9c-9114-2213e9c29bed", "indicator--29f30a51-2ded-4c19-98ca-1cf1ca28c7be", "indicator--b2200a46-ded7-4fcf-83a2-2e79dc3e6830", "indicator--0af34594-187f-4579-b908-544348de7fbe", "indicator--23f93efc-4c96-4e82-8b0e-d7316fcd73de", "indicator--353d16d9-1bc9-4521-b290-f4acf685a1b7", "indicator--9130ce09-a70e-436d-82ac-320cc0ce9e90", "indicator--035a27ad-1213-4d58-89bd-e3e0413edef9", "indicator--05187367-fd03-4188-af79-6925a16257e5", "indicator--1b6d2c37-061b-42d2-8ddf-ab242361f884", "indicator--7dcb1633-8a7c-4e5f-8161-c395c8616af4", "indicator--149e61b2-f21f-4a13-90d9-ad1456dcb9a9", "indicator--69350fda-5b59-4b7d-b710-52d0f64db249", "indicator--a5da7ac3-7347-4dbc-98e2-b801aebe08ca", "indicator--a53078f1-f24d-4e77-aa60-8452ce0726c6", "indicator--276bcb49-e40d-48c8-9104-f8bbf5ec6a7b", "indicator--e649d35b-f5cb-4f9c-b130-20eeec9b139d", "indicator--3d462583-d084-47bf-b837-44023deed221", "indicator--70905438-38b3-4a02-af16-b164a8951a95", "indicator--43fcc3dd-1fc6-428f-be31-5be26eff15f3", "indicator--e4716c5f-e01c-471e-812b-74c4d7e6f4e2", "indicator--9c67068c-9621-445b-bc9f-2471eee5250d", "indicator--c58aed18-6489-442f-8576-f1c0c313e541", "indicator--0c051d6a-912f-47ee-985d-cb11e9c21c22", "indicator--c1c1351f-944b-46c4-ad1d-eeff5cb57ea5", "indicator--771f6464-b75f-4bd1-b214-7f713eec2018", "indicator--a4dcb7e0-4b5e-4e41-a758-25a0b7abc37c", "indicator--8f86a868-87b8-4082-a230-0e2aa565a916", "indicator--15897449-ae39-45b6-aa20-7bb7db9dd8f5", "indicator--caf658c7-e683-4b5a-95e4-ea493c83068e", "indicator--888d3dc3-da54-4a0f-8673-fd8ccb5ee5f3", "indicator--da9badb2-638a-4bee-a17d-a72c671bb291", "indicator--3a3e1d21-28ac-4c06-b465-f5e53bc445e8", "indicator--1183a40f-ac2f-43ef-8f9f-01bc86b017e2", "indicator--02578c31-bb3d-414b-baf0-e18e263914ed", "indicator--9d884c63-7c3e-4780-bbd5-210c56c39c24", "relationship--c329b06c-6394-48c6-a7ca-83c9b81bba32", "relationship--659f26f4-a1fc-4fc3-a6c8-2c9fa6613e13", "relationship--0c5cc543-f4bc-43a8-a41c-ce05d7d8bbf1", "relationship--8373ca44-07f8-4662-85a0-505e0b3ff513", "indicator--58b850a7-cddf-4fa7-9bfd-a3c2fd994b27", "indicator--b7177c1b-e7d5-40b5-aa64-cc785f203313", "relationship--c5530e0e-b7f2-4031-9237-bca75b5b63c2", "relationship--8afa779c-5b42-401b-9c0d-05f59bd89a16", "relationship--8a75ae50-518d-4de8-82c7-1fe74428efb7", "indicator--b3617e02-0ee1-43ea-87fa-47be936e8849", "indicator--26db2c32-aa2a-4af5-9a08-724c51917255", "indicator--ba72da84-244b-4829-bb7c-2de1ac898b9b", "indicator--0bafdca0-2a91-461d-8087-e869b0fd37ab", "indicator--df456f2c-71ee-4c76-a53a-bbacada1e13f", "indicator--205c9729-78a3-42fb-861c-42438d12ac43", "indicator--5b1f37ac-1074-4f1a-99bc-36e5ba3721ed", "indicator--fef4b46e-dad6-42b6-8285-7d5e175745e5", "indicator--a9c4b9d8-ff05-47a0-9d2a-9a608301b0ea", "indicator--cf35bd09-1dee-446b-900d-0f120a6afc0e", "indicator--cfc0213f-38da-44a5-8c75-1b6990f5fc2c", "indicator--f5740431-3fae-4e87-a3b6-8e2d3a1b1ee1", "indicator--e3745789-94df-4ed5-ae77-9531ad5fcb79", "indicator--fe6ac659-59bd-46c7-b767-360c19c20a52", "indicator--bb3299e2-c867-498c-9986-a8c31e4c28f0", "relationship--2c08896c-a101-41b9-8ec8-aa38747fba27", "relationship--f8394778-538e-4f6f-a44c-58073b2113ce", "indicator--f7374d64-2c63-4f83-98fd-09e5a354a9c1", "indicator--c13af42e-f03d-4893-8ac1-ffa38cf78b3b", "indicator--3c9368b4-4561-4d10-bbc0-8b66e3d41073", "indicator--89fb2b3c-b383-4bdd-aebc-da0daf85ed5a", "indicator--64b45716-cb57-44ca-a8c0-7ec88da89d51", "indicator--2dc93353-7afe-4e6a-90a2-74e214a61355", "indicator--62258b92-629c-43f3-b559-41f369e3c14d", "indicator--b5a186c3-f24e-4be6-855a-e5b5f7fa8d71", "indicator--b7e18bee-5bb1-4b61-9668-546ad4d72597", "indicator--5aac70d1-e7c2-43c9-933a-dbd75e7165c8", "indicator--4591b193-2b11-433b-9057-2d4d29250319", "indicator--8b88a5a5-b540-453f-b9e8-6257047a5e19", "indicator--84c5cede-7a3a-43c6-a7d8-7a5d9c38de85", "indicator--d33b873e-0c47-4ceb-aae1-12362e1f4831", "indicator--cf02681a-c871-4dcf-add7-626a033b413b", "indicator--6810b7a6-6366-44d1-aefc-1123fa2aa924", "indicator--11f147ab-ff0f-4e23-bafa-ed2395183b77", "indicator--fec2809e-18df-4e60-b10b-d542c20fdd6a", "indicator--d71af5e0-a83a-4c44-baf5-fdb66f8a434d", "indicator--d785035a-1513-4e2b-afb5-58c76240223b", "indicator--09a77fdb-218d-4cd7-b0c4-116646e7864d", "indicator--c9cf2473-2973-4f0b-a103-91a7a7e4a454", "indicator--c84c5011-8a3a-41c9-9dad-11d06f7edf10", "indicator--278bdca3-be4a-4109-942e-cfa5b2d216c8", "indicator--8bbcc595-6c77-41a8-933f-ec9b9c76cee5", "indicator--57766950-c112-43db-95d2-5154c27f9cc6", "indicator--36b737c4-a2b9-4e37-ba60-58d497049bf3", "indicator--ea94379b-d725-40c3-be44-616bd8f3f817", "indicator--d66ab795-5a8c-4985-9068-05e5c2cba3de", "indicator--5a479991-108a-47ff-b85b-689066453a96", "indicator--7262872d-b229-4ae4-a321-c51e4799646c", "indicator--f319e713-d6cb-4c50-b59b-d1f39ed02ab7", "indicator--3148b789-d705-4fe1-a3bc-ada0e610d5c5", "indicator--a8e45bc2-54e7-4d8f-826f-aadba5ba300f", "indicator--433d3095-b782-4cb3-90a3-68ae0f6cdb32", "indicator--6bfb6690-6db5-435a-9af0-020ea9d8f10d", "indicator--6e2a8ef2-d2e4-4af2-b366-f08067da670a", "indicator--d7a3e34d-b271-440c-95c2-8e3b08594b9b", "indicator--462f08a1-d2e2-441b-a797-8d446088a567", "indicator--8114b2de-6862-4b18-b231-1da7de9084b9", "indicator--7844ced1-a6a4-4242-a9ec-255033fb6e0f", "indicator--3c6f0397-c3db-4073-ab65-87ecf58ac787", "indicator--8c2711f1-7343-4c8b-a1bf-d8ea8f8ee67e", "indicator--b228bedd-35c2-400c-926f-583af52543fe", "indicator--ab697c6e-6518-4eef-ae5e-d3f9b79f9b14", "indicator--d204625c-fa1c-472e-9712-1f74a47309c2", "indicator--d0a29693-da6b-487d-aec0-8c6ba13da456", "indicator--e0be2914-a512-4626-9e5a-2a4b2ed8c831", "indicator--afa56a1f-f060-4c45-a69b-edd9e792be71", "indicator--4b537957-bedf-484c-8442-3548cbca567c", "indicator--f9055fbf-4909-4c70-a2c2-9f412ac8700a", "indicator--fb1159f2-2f95-4899-84bf-f6d26561b20d", "indicator--3d8b66c7-ec20-49b9-8e7a-8988bbc12cab", "indicator--720b3aec-2a6d-456e-a539-877e8f1870e8", "indicator--df9d54d4-8ef6-4111-bb76-74d5f2692f56", "indicator--637fb70b-e04e-422a-a3da-736c0fb9f58b", "indicator--b314498f-da05-4f21-97e9-6744319af556", "indicator--2f04b4a5-db92-4bef-9a5a-9835ccb79c5a", "indicator--0db4a589-4079-4f6f-897d-832933078d49", "indicator--58db5632-643a-404c-ac0e-4a1133940c94", "indicator--3885541b-2cc2-4f2c-b410-1637d1ea6641", "indicator--59f82471-86d8-4f55-becb-21c0ef90fde1", "indicator--76d06f28-89c3-4db6-800a-166073b72eb5", "indicator--45f8542e-312c-4b82-b7b2-1c1a9fd75766", "indicator--f5737c15-bc0c-410d-9033-659d671ce7eb", "indicator--45e473d1-8646-466e-9b9c-0859c7e6b305", "indicator--859ddf9f-5449-450a-bb79-cb5b7dfaf9f3", "indicator--9e326ee7-db55-4143-ac60-255c5d0e9594", "indicator--3081cd56-9b99-4517-aa5c-72aba08df0e2", "relationship--95e9f542-e80f-4ce1-88f5-5ba8f4b9a37b", "relationship--b5001960-ad3a-4bfe-a9c3-b11cf8953a4b", "relationship--a9fcba81-38d3-459e-a4ae-c378fc813e57", "relationship--fe9ea90a-850a-4133-a9b5-2322385a4100", "indicator--e06ed415-4593-4b68-9c14-ba1507a5ef34", "indicator--a73a0fdf-e2ec-4c41-87e0-421b872d8444", "indicator--ef10b2a4-7771-4021-954b-fc8a98031db3", "indicator--e785d3c3-b4d6-4feb-88e9-7e5a0891d9eb", "indicator--ef738523-ab44-4f7e-bc36-01b6482acf34", "indicator--33375e9f-cea0-4b16-b721-9bcb08879e19", "indicator--994aa906-cc4b-4f00-ac62-826cc1ecfd1c", "indicator--1978240b-1de1-4519-8e4a-44807b104711", "indicator--26edbd14-7f6f-47fb-bdb6-097dafc266a6", "indicator--591288fc-922b-4027-8725-32c48eb45a4c", "indicator--d89bf381-48bc-4d4c-9faf-c34578925acf", "indicator--b18b02ba-28f1-4e17-967d-c72f14f4bf87", "indicator--2f904b7a-40c6-4d8d-bd94-3bda4c37e94d", "indicator--b1147f8f-8862-4545-b001-fc67cf7fdd7b", "indicator--94692b65-12a5-43c5-9d43-b25b4f78daba", "indicator--870a34c4-3227-4b45-b018-827f0cb41960", "indicator--e1978d0a-1dd9-4922-aaab-2df571480a40", "indicator--3a61cda3-db91-415e-a529-bdc204e0db61", "indicator--9828a83a-2f98-43ed-ad40-c2ec3432d4ee", "indicator--1a95ccd8-46de-42c6-8f06-a26b9c7a5243", "indicator--156406e8-5a78-4363-8aed-21855da262d8", "indicator--bcc17156-0f61-434b-943e-ad1ffca82bd1", "indicator--33d1fb49-5218-4325-85bd-ad9febd0f53d", "indicator--bef222fa-d9ce-4d12-986f-c2edd23c51f6", "indicator--b2317250-d96e-4e39-971d-9cc9e23c36d0", "indicator--72fcd580-50dc-4d2f-a42d-47c589a0f426", "indicator--47afc981-7a46-4ff8-b884-4129d2962b24", "indicator--cb756a73-1fa4-4357-9262-56fec3d5fee6", "indicator--c753fa5b-8d36-44ec-a52e-5986b970a223", "indicator--11e58df8-4199-4fe9-b9d3-608dcb03dcff", "indicator--dd843fa9-1761-4841-82eb-20ae9e24f8b6", "indicator--6e746b26-1745-404f-bc53-4c625c6ed0cf", "indicator--ee33ccc7-73fc-4a28-981a-7cb80606332d", "indicator--1ff22444-41ba-41a1-a447-bb03013c45b4", "indicator--0ae9469f-10ab-4c94-b548-36c13c782fca", "indicator--6a8943f8-b23c-4362-ae8e-067effd6d411", "indicator--0a084835-4d46-4e95-8e36-256aebd585cb", "relationship--be62c65d-19aa-4a92-9fb5-d18e6b60ad56", "relationship--802c0e4d-2b0d-4024-bcb0-c289cc2856a2", "relationship--13b54936-1ca7-4b04-ab80-af757623d17e", "indicator--3ad6f62f-cb08-4a82-b6ac-7c8d986d8a4d", "indicator--85f9e9ff-30bb-4bbd-b991-81ada1701dc0", "indicator--23d8230b-d792-4cee-88c4-8ab9cb3dc53c", "indicator--8d4d326b-7265-4924-8de9-3f89f4650afd", "indicator--aa47ceb6-aa37-4deb-828b-7c789477d02d", "indicator--3d52be6d-4669-4bd5-b7ae-96782c313ac7", "indicator--bfc0d836-63ba-4d22-b47e-75fbf4a64036", "indicator--cbfb4d85-0dc2-4041-85f4-e769e91f1cdf", "indicator--a5627ace-354d-4e4b-985d-586aafc0fd95", "indicator--5881aaef-e1f0-413d-83bf-480bcbc1d2e5", "indicator--738399a7-47b1-47ce-ac34-d1ae362f6d64", "indicator--a84d930b-bb51-4b53-bcae-585c99feeeca", "indicator--20cf1ebb-4dec-4373-a108-b5d803f9d104", "indicator--4a1dcb25-0cb3-49d9-8183-baf086a4a8e0", "sighting--18d4bb35-3fc0-486f-ab65-f30165c5afaa", "sighting--6a04e415-c598-48c6-950c-1d5b616d06c3", "sighting--6e04d541-7e65-4a2b-89d2-75c62ae2ca39", "sighting--a0fe5ad7-fb56-429c-85f1-7c42eb1653ad", "sighting--dc498d54-1209-42a6-af04-6232f2ebe139", "sighting--e3838d7f-40db-42af-93eb-1023ffb1215f", "sighting--e6ea6ee8-e321-476e-ba73-2bcebad4977b", "sighting--cc8ad747-53d3-49bf-858a-887792b4afb5", "sighting--86735c3d-4d36-4e1d-9341-ed28f6d9532f", "sighting--14d2742a-8cb5-4554-8b5b-8ad85638d232", "sighting--f6778cbe-66da-4487-a841-9e285bb70128", "sighting--9cd5c610-8401-4b07-94c5-f7c10726decd", "sighting--b9764881-4430-4508-ba09-b8f70df53d5d", "sighting--5f32a6e1-0c3f-479a-ba3d-7e8555386fa6", "sighting--4d4f4689-88e8-4515-a234-f96d80856b40", "sighting--6aafe897-c7a0-4dd7-8463-98c41769c383", "sighting--49e31366-5171-4efe-a9a8-c59921e33bbe", "sighting--6ef64be6-52b8-4354-a007-b89654125c80", "sighting--fa31d286-d3bc-434a-a0ae-583d719e6f15", "sighting--0eb8506e-3e32-46f1-ac75-5bce5481cc69", "sighting--c3f0118b-13a7-483d-a468-27e297c4dfc2", "sighting--efae85b4-a4a9-46b1-abb1-c1a8f924b7d2", "sighting--35ebcefb-d49e-4366-af4a-0ac1efa4e70b", "sighting--8d1b43a5-4b9b-4517-b6ee-c1cdacfe2d75", "sighting--8c864522-3d35-4f71-8824-662eddb8d996", "sighting--a20330c2-5704-43ed-aea2-080a1ccb4bea", "sighting--7b947b61-a846-4c91-afb6-97c25ae51d7d", "sighting--e8767c68-faa2-40e5-b8dd-9605866e34ed", "sighting--613a6594-2f55-4332-9600-086dd3ff5f7a", "sighting--bc0d1e07-8ff4-47e3-bc5f-e50e4c370ef4", "sighting--93550106-e3d3-4046-92c6-9d1b9f885539", "sighting--b8da2444-568f-4b62-8361-1f334dea4bd4", "sighting--d88d1c6d-4f8c-4e77-90d9-a72403872f38", "sighting--3439e035-9842-4bfb-809a-5e22331f4759", "sighting--7bbb1f88-1d21-496b-b2fa-403970022ae2", "sighting--839385e6-bafe-4a97-945b-18f9bb68dd28", "sighting--f8d8c987-e4dc-42c3-b509-d0bdf2376dca", "sighting--cdc44e89-7cfe-4a5d-a2c7-9c7851206181", "sighting--30787166-0f69-4478-9908-0e2737626ced", "sighting--339274fc-73b9-43e4-bf0c-4c4d716e6304", "sighting--c31d7bbc-bd2d-48d4-ab37-a4453f81d8fb", "sighting--c6999a66-5c28-4753-a3f2-da517eb4e865", "sighting--1fb929bc-be35-4b0c-9cf7-cb13655a5b99", "sighting--d6addebc-17da-4bed-9066-c5b2015b55a2", "sighting--4bb6de85-63c6-458b-8413-1369408a5e81", "sighting--79a8971a-17ce-4ceb-9787-da24b7562f72", "sighting--1bf232e5-540c-4962-bbba-d841d2c434b3", "sighting--a85bd391-bc38-4249-a80c-c760e6c77c5f", "sighting--c905dffb-9df0-46da-92c8-d93c9a807fb7", "sighting--b2b2d33a-b217-481a-96fb-6fd32300b3f5", "sighting--05a48e6e-81f2-47e2-a7e9-70509a8bbc76", "sighting--887dbc79-5c38-4b7c-911f-069578540ffc", "sighting--1a383999-c16d-47b3-825f-1afda9d2dd4f", "sighting--f4183f81-180f-49a0-90d6-95a7128ea223", "sighting--bc6ab2eb-8db5-4bbd-b7c2-dce7cc156ea5", "sighting--44819d6d-c90e-46f2-b7ed-19a3e9c9a485", "sighting--5a8f7908-24e3-4d71-8895-1ba4645a0eee", "sighting--8ef31000-fcdb-4e10-9dab-67b29ccba827", "sighting--bef8d38e-48d0-430b-a913-579779442808", "sighting--844cb0e2-ec4e-40b2-865c-3e0f8d1a7804", "sighting--664868a3-8549-43d3-8684-8c5d362f0f92", "sighting--da425e7e-02e9-429b-88e1-daa7f2426ecb", "sighting--620a1ef3-a2c9-4249-ac41-38605f058ea1", "sighting--c8ce4a78-2840-4b2a-9c89-e91895dd2bb2", "sighting--35da484c-d777-4f20-b881-af78127f8404", "sighting--eb62003c-3708-499e-8c83-a30c87c69c01", "sighting--dcf2b3f5-4531-48af-a2d4-0a9665611a4a", "sighting--f1a69b2b-26b8-4003-b394-85574fabb78a", "sighting--dca161b7-5691-49e1-a63e-d21d718b30e3", "sighting--5cc55ee0-a28e-4e0f-821c-c218aa2573ab", "sighting--9ff03ee9-3bfd-4da8-a629-4f6034966a8a", "sighting--01541de3-bfbc-4014-817e-996fb7a181a0", "sighting--820c429e-3672-4cfe-abcd-b1b181498ea0", "sighting--77993e80-a10c-4877-ae28-cc1cf77fdd49", "sighting--3c69476a-1e9f-4d08-a61b-cbe838303c56", "sighting--b189c060-e18e-4ee3-a28c-c1e1c31f15f3", "sighting--ae5c6ef0-4ed2-4c65-8940-078845918cc5", "sighting--377e0f23-def3-488e-8e93-71f8df6e53d1", "sighting--f854086a-9ce1-4932-9f21-66c31335c55f", "sighting--09c1077d-1dd5-4ad0-8d7d-227b2f7fffd8", "sighting--be9ffcd7-0f0d-4c4b-b033-b913cac17db3", "sighting--454c4fd6-22b7-4edb-a8c4-a95a58fa8bc0", "sighting--8dc902e6-cd64-4068-91bc-55fa6805419d", "sighting--e6f0c868-13f7-409b-8196-00ac67b44ebc", "sighting--3657a77b-5ad7-40fd-9ba7-4faf41e799a1", "sighting--86425c74-b3b5-4154-87cc-86e28c6e3f49", "sighting--18e2806e-c27a-4d63-843f-578fa8472dae", "sighting--2e1600ee-f3b2-45f8-8d76-e2f4ce38fa3e", "sighting--1959b9fd-e30d-40de-bd2e-6e2ebc984518", "sighting--1aea2373-e57e-4848-a6a9-a16b61540926", "sighting--56c9c83b-8f90-4bef-b937-07856e289a73", "sighting--e0f671c7-e473-4544-ad3c-9a548b4b0987", "sighting--cf356cab-3063-4487-9496-00703f098d8f", "sighting--e0dea86d-c8ab-4909-bdb4-da0b8f32fd92", "sighting--a045721c-1fd9-46d2-842a-cf0f5eb18aba", "sighting--81b167f8-b14d-40b4-9bcb-22058091b45d", "sighting--898d4fe5-b259-40f0-88f5-be2481dce17a", "sighting--1b722997-26c1-4730-9b69-736b6dd83554", "sighting--b253ba55-5924-4a35-a356-f916fa9cbbae", "sighting--19b082b4-ff32-4f56-8450-f901cde10d50", "sighting--82776aa4-c9bc-4825-9bbe-8662c3e497ba", "sighting--ca87aced-12d6-4f95-9217-714eb73acbb3", "sighting--538ca1f4-4e4d-4d09-9ecb-94272e6494f8", "sighting--58957c79-9806-4e84-8395-962a0c82275d", "sighting--365d8d93-4144-4687-9fa4-503dccce6c25", "sighting--61dc58ea-0f5c-44f4-b866-21e08996b254", "sighting--4144725c-bc5a-498d-924d-16244056d310", "sighting--b18b0d11-58fd-41c8-94c0-e61826f931b5", "sighting--96e712c3-1056-4f67-bfc5-45387c2b7962", "sighting--90b1cfc4-b4af-47ea-8901-294e18e74ab1", "sighting--6c3089a6-d3d8-4adc-8046-704ddc4971da", "sighting--53fe600e-464a-444e-99c9-4c75595721e9", "sighting--d8f40b56-8ed8-4a77-9805-2b7d5f848460", "sighting--abd49921-72dc-4066-a3e2-c864881f7893", "sighting--4e02571d-6ab4-4948-a2a8-4d4222d0acd5", "sighting--62a5e10a-afb5-4631-8a36-6a6fc29b1474", "sighting--e7202319-308e-442f-af5f-8b3b20523fb1", "sighting--679e3578-4d19-4186-ba64-7c4ce70bdab1", "sighting--4cef5c5f-97a7-4075-8e0e-7bbb25f862cc", "sighting--efc9f0a2-c3b0-45a6-bc16-aacf57cf846b", "sighting--63162a2d-cff6-4d62-aea4-cdd7834a71f8", "sighting--91c135be-dc8f-455b-ba25-4673286b758a", "sighting--81d3102a-071e-43e3-9c2a-70e5f9aac809", "sighting--11b378be-f5d4-470a-9650-d64db1c56352", "sighting--23b933b9-1239-44d3-9ed0-735b08928fa8", "sighting--8ca292aa-04e5-430e-9115-3425a556ab25", "sighting--2a26d6de-6029-4efb-acf5-c4c6baffc49a", "sighting--d86834dc-09c3-4f4b-a6bf-4f0201265246", "sighting--84895242-6f01-405c-8a32-8e8836b5a8a3", "sighting--4f0bd1ec-fac6-4de4-9d18-98c8f2cf1e8f", "sighting--f3620f4f-13b9-4372-8e4e-880fc19b9032", "sighting--cec5700e-6e9c-424e-84c1-8c73623e4c1c", "sighting--e944367c-8afa-4cba-a61a-50f729797dcb", "sighting--14c6c210-b407-41c7-85b0-11024307c796", "sighting--b4d17777-8f57-4829-b403-b9189f3ab303", "sighting--113a39d7-66f7-46a6-99a1-229c0f0c27e1", "sighting--d2228f76-25cb-4a00-bb9c-64e2cf030ff4", "sighting--c588fae3-ea6f-41c8-a077-48f79bd06f58", "sighting--3f9d6cfc-cc96-4de4-8eea-69b639259857", "sighting--ceb665a7-794a-415c-8d3b-715b01bc3359", "sighting--111ca43a-c7fa-4b41-b054-72f768949c8a", "sighting--146b334a-c6d0-403e-a981-3613496a0e6f", "sighting--cada471e-3964-4ec5-8904-3494275425d9", "sighting--4609566e-f91f-4df8-9136-436fc75ed4c6", "sighting--4049fca3-1ab2-4f97-8e1c-7ce7cb19acdb", "sighting--6d0eba0e-819b-4431-b361-0f9583eda48a", "sighting--93c6ee9a-7209-47ea-9d3c-47fc9f3137e1", "sighting--293cb42a-201e-4914-afcf-e70251fa655a", "sighting--bea052a0-5a58-4e03-ab52-eace9b4d91fc", "sighting--3be0ec00-3639-4d22-8267-264517af161a", "sighting--fe5c2c3a-f878-477b-b453-515f826dcdef", "sighting--0bfc8e96-1608-4caa-bfa2-653132db1229", "sighting--114950bc-e703-4ba8-bba8-f8eb449e55bc", "sighting--517c5e19-b251-44be-8580-581b2423ae89", "sighting--0796dd4c-258d-4f3c-a67a-fcdf30998cb9", "sighting--d0e32442-a142-4f3e-b9e0-0f4c02bc202f", "sighting--9f26f4da-914a-4fd2-a82a-9bc3c36a154c", "sighting--06454754-176b-4de4-a2db-12b140c631a5", "sighting--7e78a925-14ad-4ccb-a198-d1fbbceb1672", "sighting--53f591c9-c78f-4f54-a061-2c9ff538201b", "sighting--d66eefd6-c3da-47aa-93ce-4a2bf159ff41", "sighting--77325ec4-1499-472d-9470-9510b142095c", "sighting--144591de-979e-4128-836d-4a55066d3d56", "sighting--5968abda-c7c9-4c0a-bfec-89973876dcdc", "sighting--33208c1e-0020-4e81-a954-f9bf3033c5b5", "sighting--3eb323e2-4028-4962-974e-dfb14114c717", "sighting--66fbd402-0328-4061-bc43-2dc1478f63df", "sighting--44836917-4113-4b3e-b8f6-2b07cbab8a50", "sighting--46f2ed00-035f-4564-96e1-ca5d82533879", "sighting--9e27d8de-e2ce-41dd-ad67-ee75fe036f65", "sighting--a7720ba8-6acd-43e7-8806-2406179e5063", "sighting--ed7bd80d-36e3-4268-855c-48c9f9bf07e8", "sighting--637dd52f-214b-4ad2-8705-1d0fbe0ad273", "sighting--00664ac6-c828-4bb1-84a9-c8dbe17c4954", "sighting--b1565f34-5bcd-49ad-853f-b4077037a4bd", "sighting--9afa5e16-17d1-4a57-92b7-95e31da1d98c", "sighting--be40f894-3881-494f-8f38-b9cf9441eb6d", "sighting--8ca9bc52-63a6-4aeb-9101-5994b9861e6e", "sighting--69f8953c-672a-4fea-bb77-4b4e591d63e2", "sighting--785a890f-b6b6-4e8b-b3c9-f3db68f14559", "sighting--1e834bc1-c278-402f-b460-3bc50d7c7ecc", "sighting--ef53baa4-5feb-4fda-a398-ef77e844ad72", "sighting--8c2ac0d3-cf67-4283-b42a-4511ab18fba9", "sighting--02295c0d-b5e1-43c2-b218-0a1f8698ad7a", "sighting--1bd1ca2a-0124-49ae-9e0d-8c4dd1a35fb4", "sighting--695c160b-3b75-4675-a548-2d4b33d29c1f", "sighting--1fdd0851-bfc9-40c7-b904-d36ee8fb9695", "sighting--46fd9cdb-30b4-49d5-ad09-0aa35df2584f", "sighting--e69577e0-1c15-454a-8f22-ee6aac18ac52", "sighting--1a579bef-f0e5-481d-a6dc-8681fd0b3ad0", "sighting--e7c209c0-a23d-4566-8cdf-c40d309a236a", "sighting--e2cdd09d-fa2d-43bd-a68b-33e36490d022", "sighting--401a6aa9-88b8-41c3-af9d-6211af4fcf1f", "sighting--53bcf8ab-9c1e-4534-974c-1f8e580a3366", "sighting--80e4407f-cfdb-4b23-b850-fb1ed5cca842", "sighting--0adb5020-1cbc-4cf4-9a85-bdc1318e8ae4", "sighting--5c7b8b01-5e4a-477e-8695-346c86c8eba3", "sighting--ab06408b-6f77-41f0-8127-c13aa41adf3a", "sighting--442683e3-dc38-4aab-a829-1f7a10236a4c", "sighting--f4b1d802-dc30-40d6-a627-f09468affef2", "sighting--528363f1-cae2-4c46-aef0-0a6157c18f33", "sighting--80c518cc-d5a0-4fdf-b0e3-fae10807b71f", "sighting--3668d99c-8a7b-4d7c-b20f-30b66a5e6fa0", "sighting--1d26b021-e45f-4be3-9c8e-683c9ac77cca", "sighting--415d8506-d201-43df-9ddc-ed528a27f21e", "sighting--5224ebdf-93c4-4bdd-bc9a-1a53c6e476ff", "sighting--c983e68b-fe35-44c8-bc1a-bb18a06b783a", "sighting--ba200fc9-c470-49d1-9d40-bf2c6b3af8f0", "sighting--9739cec2-2962-4a36-ae69-475917a9660e", "sighting--3195ba74-9d09-4bd5-9dcc-3e3cfc62b252", "sighting--7e27388d-ae86-4524-bb1d-4ce59c37886f", "sighting--8f63bd82-f637-4d5c-b2f2-895a2602fc14", "sighting--f8eca0ab-900b-4ffa-85a7-20408ece3bd8", "sighting--8e8e2c12-1e38-42d9-b91d-a81f332e9e6b", "sighting--584f01f7-25fa-4912-b903-68399108ef68", "sighting--ba1158ef-b678-464e-8c43-05dd36af1675", "sighting--4e6246ae-787c-4761-8ddc-2939d629dc2a", "sighting--1174553b-d553-4b9f-87a9-fd760d0a9c65", "sighting--0c7e22a7-2778-4a2f-a56c-3ca8d21ca727", "sighting--57dd3048-c556-4f3c-911e-f02442400fe0", "sighting--ac7eb5eb-1924-4269-a64c-72dd9b635b96", "sighting--8f47e79c-4598-4c30-8e44-522d84c1de73", "sighting--1159da8d-9e10-421a-8846-96275bf7906d", "sighting--f77c6c88-06ff-46be-bfde-a9d795fbe36a", "sighting--3a91a739-1c19-4d03-a15f-0b20344bbadb", "sighting--23a79e6a-d2ab-4630-88ac-b33643da5c8c", "sighting--0ba9d176-0ceb-4c55-bc06-6e4fcb65b437", "sighting--64d61f3f-91f7-437b-9c48-384ee2084087", "sighting--1b808a0a-be5b-4548-ba28-c21cd432f8e2", "sighting--bbdc6f78-9b14-4f15-a548-45ebd69ac1cf", "sighting--e8a2823e-0090-4652-8772-c3c78a1574f7", "sighting--6849744b-1dad-4fd4-9c22-88be5bf9101f", "sighting--151368aa-38c1-40da-ad00-6681d5701b82", "sighting--20d8e770-2bb8-4de9-b045-49d95a35b0b2", "sighting--3b03d4e4-9b5c-4058-a05e-8bf999fc7df2", "sighting--0351a5c1-0170-482e-ac6a-69dabc592fdb", "sighting--c19f79d2-f00a-4064-93b9-98cc0f4a73f8", "sighting--371de49a-e613-4fd0-8a9a-90230627a56f", "sighting--c24caa48-67bb-493b-a05f-d11098f4078e", "sighting--02a98d9c-48be-476b-8b1f-4bbd7227ff4e", "sighting--34651ae6-7336-4cdb-b404-f180a81e52dd", "sighting--17bd0cd8-564c-4ae9-b98d-6dcbab8be2c8", "sighting--5416348d-79c3-4c0d-82fe-3fdd0641b892", "sighting--4ad003fd-7b13-44ca-ad98-9334fc68d9a2", "sighting--8df68ee2-8ff3-4493-a1eb-20e9023fc57f", "sighting--3c0dc3bc-6af0-4ac1-95b8-1970c5278acf", "sighting--6159ef7d-7957-4054-b4c1-caea8587b47f", "sighting--45964bca-2731-4cb9-b6f0-17aa76d372f8", "sighting--cd5b7c63-b58d-4a8d-b1de-69972fe72c66", "sighting--4e5c83c5-1357-40f7-a3f8-e59b35635692", "sighting--f0381a28-0e40-4507-b5f2-0fa030f3ffae", "sighting--2543a41d-ecf4-4ecd-830f-f8db297c352c", "sighting--8608e9e6-e026-4aef-ab54-8f8918af3476", "sighting--8c058874-e5df-4531-ac82-1f1bf29292d2", "sighting--3821a715-7345-4081-b1b7-195861295180", "sighting--aeffea43-e37a-4938-a18d-d4ea63f08d80", "sighting--547f87d6-dd22-45aa-8967-8895e08e7431", "sighting--9f86ed55-f76c-476a-af6c-96b0175ea855", "sighting--9c869e72-a06c-4738-868c-33c6cef771f0", "sighting--34327522-ac2c-4eaf-bff2-fbdad4d29314", "sighting--e769421e-0c61-469c-9b99-ea0014c0b353", "sighting--5ede6040-3ef3-4d59-a391-0ffb144281bf", "sighting--6ba19858-573e-4bef-a4a6-f5d000cc5d4e", "sighting--19f1ff1f-6519-4751-ac87-7650f50a1d56", "sighting--895cff2e-1c30-461b-83ee-bc1447a0482c", "sighting--3b7ef943-98be-44be-b0aa-401ccfea2768", "sighting--0936daea-a686-40fb-beb8-7e83c0880a70", "sighting--febcc5c1-528c-463a-85fc-d10c55f052ba", "sighting--17169c3f-36a3-4028-896e-5194073e375e", "sighting--d5f860a3-509a-41be-a19c-b448f7b2f2a4", "sighting--c0eb4ace-d2e1-4bd5-8469-e93043a15581", "sighting--e4aa495c-077b-4d83-8c71-316bd4f4893d", "sighting--6d0273b7-4c22-4bbd-84e6-20083a09c0db", "sighting--83f47871-90cf-45fe-9763-de874be87dad", "sighting--6e526bfd-c49e-46b1-9449-04d5cfafc249", "sighting--bc6d6519-d4f6-4a11-a121-1804af6867df", "sighting--b4bc6153-d3e4-4865-a88e-92fc19991ac8", "sighting--d8686e88-1b70-406f-894e-dfca08d37d6f", "sighting--fe813863-1eac-4fd7-8204-38c371b9d814", "sighting--ab15f739-39d1-4f87-b335-552e9b106c26", "sighting--8a312e8d-9419-411c-bd27-4fd823919baa", "sighting--09d5ced5-d578-49f5-a7d3-e4f2292673fc", "sighting--e6942df6-a51c-49cf-9adc-0beb362a9c7f", "sighting--b27cb7a1-186a-4629-9c55-e85a5226b956", "sighting--2584390a-21d8-4447-b449-a90bedf8389b", "sighting--acde9e24-43e1-4c3b-b5c2-5ccc39ef2b9d", "sighting--886c2827-a938-4413-8a19-40d0dec4237d", "sighting--a2fa17ff-d09e-4025-a855-dd48293adeef", "sighting--edf79ac2-bd51-47f8-84f0-0179e0c9e3d0", "sighting--93934999-76a5-4993-8284-47ee40546ca0", "sighting--162471b7-a22b-4441-9c47-d8615b9d3239", "sighting--94168ef5-5f0e-4e03-9cd1-7c5e56a0a4f4", "sighting--2ad48acf-95c4-490f-8476-8291d96937d2", "sighting--dfcfb091-a818-4504-b5ca-713b3154fe27", "sighting--67c1f891-f8d9-4d1a-a76c-315c1ddfc7d7", "sighting--e20f6254-0bb8-413d-954d-8e5dd315741f", "sighting--3761aa27-8045-4808-9807-2f336fdfe4e0", "sighting--52269ba3-c81e-42ce-a1b6-83d182133cfc", "sighting--182458e3-49bf-472f-ad16-4ba1cb217bdc", "sighting--296e89bd-22d6-45c3-9a56-923dde38fd8e", "sighting--1a34fed5-70b0-412b-b9b2-2466530767cf", "sighting--3e377dcd-9663-4d25-9b1f-45f83f0203f3", "sighting--b96395fe-4f2d-4ee0-91ef-4d11e4973d16", "sighting--cb379b66-3507-4854-b8a6-3cfb87de6aae", "sighting--0eaf2170-cabb-4407-b041-4b6c5cc01f27", "sighting--3e02b068-c795-4e92-bdae-d9c15e99bbd9", "sighting--0d4698f5-f0d9-40b8-9fa6-4009a2896c29", "sighting--5d7a4846-8aae-47dd-8ae2-1b505e186106", "sighting--c854fcc0-2826-4068-ac52-50c84143eb4f", "sighting--045e386a-3117-489c-b8b3-8cf2b588eeb0", "sighting--7d72d9b5-25c4-45c5-b15d-bedde77756f6", "sighting--11f3f42d-ffcb-4589-9649-95c6405c4e37", "sighting--1c4aa7d7-0a1b-4a6a-8e93-f3fbd438b01c", "sighting--44bfada0-d42c-4fe3-834c-1c04405485fd", "sighting--d9e875f0-9a91-4b21-8ff2-dec01ba7bf2e", "sighting--dc9fca12-9948-47a2-b92c-15e6a1a340c2", "sighting--6f043636-3e73-4cb0-9203-13566a9949ed", "sighting--05ad03b3-5b57-446e-b8b3-b2efce06b7f6", "sighting--8e620094-1d4e-406b-b0d8-5320c4a45954", "sighting--2680fd69-9a45-4966-8a95-3c334fc98185", "sighting--a79e0690-cbe6-4259-beba-d0a4b5e37300", "sighting--aad2f397-e778-48b2-a55a-e1721641b3ee", "sighting--f90e160a-5acc-4019-bfc7-05c369d83dc2", "sighting--fe96ddcb-f865-41f9-a69f-8e53ee61da1c", "sighting--ef148579-60fc-4767-9509-0201d8aa3d95", "sighting--d3c3b1d8-7bea-45c3-a814-ccac0bb5f871", "sighting--165afd79-8009-41c4-97a9-8f2485ddb953", "sighting--8ab8731d-3336-4ab7-ba64-8a5b8f7a828c", "sighting--5e95e982-d7aa-4841-aa53-d88734feb922", "sighting--d2bb8f8b-b908-44f2-b7c9-99b5595876cd", "sighting--0e113fd2-991f-4ae7-bf9f-ca7666e4a558", "sighting--f02198fb-ad3d-4129-83da-33054181786b", "sighting--26c2aedf-c125-4844-8f95-5730eabbd82b", "sighting--a5b4dc8b-a575-41a4-93be-4338dbd2269b", "sighting--e9995815-b5cb-457f-8222-607e5afcfeb2", "sighting--103bd4fd-e9ef-43d9-aaab-57beeeb89d19", "sighting--645ab1c7-5433-41ec-9a03-b54ec7a03f9c", "sighting--77b2cd45-36d5-4ad8-b1e7-65a8f8ab0050", "sighting--44daa319-dc21-4111-861d-cb6faf0ee896", "sighting--0fd0ab9c-ca7d-4dce-ae59-066c52e160e9", "sighting--53f44f9f-276d-44fd-a820-36e091495deb", "sighting--0f6862ff-e1da-48ac-85cb-26aa64286b77", "sighting--26504dc4-461b-4898-9b26-a02703b107cc", "sighting--f146bca9-e26d-4de5-b783-c191f0ccd92a", "sighting--94f05c55-647f-48c1-a951-84635ab0552b", "sighting--583188f8-c797-465b-a2eb-89498c8b436c", "sighting--714e17df-d16f-44db-9a42-80e61f677558", "sighting--28789c14-275e-4848-8d72-9d10432441cc", "sighting--08546481-77c4-4f01-9e3c-72c2589e5c8c", "sighting--246b5b1f-de58-4005-be00-1634d7d01a3b", "sighting--0bc1430c-a13c-4b68-b03f-f38420a096b8", "sighting--7035db0d-d82e-4d0b-a33d-899ab46b7e6a", "sighting--b733ffbf-620a-405e-9bbc-5176b32a36b3", "sighting--5e648917-1233-4832-8201-0455f72b9591", "sighting--e28c9f35-3946-4d61-8bf5-9fac8840f96e", "sighting--dbfa8d35-9271-4846-87d5-95fa1494cfc7", "sighting--c5d3cdfe-eec8-4011-bfdc-b3261a2d0e48", "sighting--e2f2d1b2-fa22-4dc1-91f8-0a2aea4c416b", "sighting--83f08900-5c39-4931-a367-87f35c1c0891", "sighting--59126643-1b4f-41af-9fc7-8bce2caa3650", "sighting--f68635c8-ab5d-45c5-8080-01b7cc1e0031", "sighting--ff815645-d447-484b-a740-896850bdec22", "sighting--9d254af8-241a-44a4-acfe-b114b7bb7480", "sighting--6ec14c87-909b-4605-88fd-5201057b0fd3", "sighting--da4a1ffa-256b-4bb1-9086-1f489a3fcd8d", "sighting--4ba7c936-dfd8-48e2-9e1f-275947d5b014", "sighting--f08b6180-a657-4b98-8eaf-913fc40571dc", "sighting--60870b24-0f61-4010-9756-8343d8cd66fa", "sighting--b822cf82-7f70-4314-a0a3-fc5185b9837d", "sighting--1f708838-9b82-43cc-af0f-83d6b1db45e4", "sighting--fea0d0a8-34e2-4002-9ff3-bd04a491f36a", "sighting--45e45175-2908-4eea-bfea-b2cdd3fff47b", "sighting--d19f59a8-0021-4b9f-bf48-aae67f323d13", "sighting--956beff2-179f-4e97-959a-3ccc0ad1d541", "sighting--39587e65-dbf8-436a-a8e8-92e6455f1184", "sighting--b294b146-19dc-47ab-a081-9f4b4245a76c", "sighting--db02b70e-8cf7-47b0-883f-0460c850e523", "sighting--d5329d97-4cf7-4564-b4f0-0997d7530aaa", "sighting--ad45b777-ae14-4a9e-8c25-49641b6ddb7d", "sighting--181fe337-456b-444d-9ab2-cf35e44052a8", "sighting--77cf9fcf-5026-4981-99c9-8175d7c3f632", "sighting--21fee5af-2e2f-44cd-8754-70995c9b2375", "sighting--d87a6064-b40b-4f44-896d-fa73d0c91bc3", "sighting--77a20508-411e-4eca-a61f-81a856926c8c", "sighting--35f06f46-9924-46ef-8ee8-98dcb6bdbcbe", "sighting--2ebb33fd-dd9a-413d-88cb-ccfc88b13ed8", "sighting--2726b166-1be4-49e2-9452-e19289f4b2e0", "sighting--72db1f82-3a2e-4b1c-8a7d-85be2dce8659", "sighting--e9425a11-4fb5-4595-b036-a993612722cd", "sighting--0ac3a122-f0d7-4482-8670-80840cf4f927", "sighting--8a3578d8-e285-4c26-a1a8-73c8f75a80c5", "sighting--e24f2525-a55a-469b-ae31-f1e5d03e7b86", "sighting--be4e003e-8c46-4d69-a0de-b01d09028022", "sighting--9d39bb76-63a0-40a8-a239-d2e8b3311a74", "sighting--4a8d91c7-5725-4785-b2cc-4b918684aba1", "sighting--be269c15-e57e-48c8-b589-9a79bdfee4a9", "sighting--4dcc678d-9120-475a-83fc-4cf7da060500", "sighting--5590ca26-9580-4cf1-b901-f38d50742f57", "sighting--c9e8acff-8af1-477e-981f-f07767368c0e", "sighting--11fdc412-1087-4120-8fbd-e631bbf39c90", "sighting--2603d220-8aeb-422d-852c-0354402f14f8", "sighting--a9d57571-4e0d-46cb-a760-5be1d0d2fdb1", "sighting--5202e6bf-9681-4b62-b7e3-1dc7c0644ce3", "sighting--aac27e00-cc03-4184-ad19-da5809c4693d", "sighting--eba9814f-048a-4476-a888-26996b21ac81", "sighting--cce05c54-a3bc-49db-a182-f2cf7cf21a10", "sighting--13c86b7d-faae-4480-9524-7625bc5fc2fc", "sighting--2be8cf38-0c21-4e39-acad-10e0a62cb963", "sighting--1c10c7e9-cc7d-4a02-8d94-21aa9c9a0383", "sighting--c2baabf4-1854-418f-bf84-f83557eab464", "sighting--3a659817-5537-4624-a50b-993ed293a588", "sighting--922046f7-2415-4f71-b1e2-a3f11fe71fe5", "sighting--61885f95-aa0b-473b-81b1-c22da99d7ba2", "sighting--6434e901-7ac7-4afe-a650-4695e1bfc2a2", "sighting--18265a7f-1eb1-4bcf-84cb-fff814514109", "sighting--e8951b00-9e05-4ab6-b70a-83748a4c9a73", "sighting--c979d678-a9f6-4cbc-bfb0-b8eb5f28b6f9", "sighting--f85dfd25-730e-4197-822d-a1be5f274a80", "sighting--a59a34b2-acfd-4623-a621-7e7699be86f9", "sighting--dd942853-117a-46b2-9072-35f4cf580a27", "sighting--e0c3488e-e285-4667-a89d-081ac2d3b403", "sighting--1b2efa2e-c6bb-485d-aef5-b44180b9f764", "sighting--14a60278-6646-4006-8ec4-26e3a59ea3be", "sighting--fd2f81b6-b359-4922-937f-e23a1029f796", "sighting--a17fd8c2-d281-4da7-89f3-632cb6dc7ca2", "sighting--2bbf286a-7f3c-42b4-b2b3-1f4156dd2713", "sighting--257f5a78-88e6-4de6-9855-edc747a9fb09", "sighting--f1c7a10f-d79c-4585-b4d7-3e02c278ccb3", "sighting--b240dce3-6179-45e3-a1ac-ca92ec5c9ff1", "sighting--37d9a852-335f-4388-80d5-6c9197b89a7d", "sighting--f2e770ed-7257-4356-98da-1e576a80a03e", "sighting--1d84292e-8483-438a-ad30-72beea52c599", "sighting--01e491f0-3cba-43fb-b93a-53d6183748e6", "sighting--deb3dc88-fbe9-46a6-b880-1b6017fde7b0", "sighting--6311f235-0466-4b0b-88fc-22fad1a1130c", "sighting--96ab4818-a4ee-478d-a80d-3c39e86be26b", "sighting--9f02249d-60c2-4057-9a38-8d856c4c9578", "sighting--64885b15-f381-4526-b452-2ec691fe0c9e", "sighting--d0adac99-ff9a-47e7-a6c0-3e9ae746a551", "sighting--b1f217a1-5b2b-4c10-8990-4af1aac5d913", "sighting--d11818e2-5617-4813-872c-e8fd754c1657", "sighting--528b2e5b-5c48-41b5-a9ca-085a8cd4b9e7", "sighting--c9bfc99e-17f7-40aa-bc2a-9d667a5d34e0", "sighting--b15d0f37-906d-4170-b653-146a589a31fb", "sighting--3207d693-f8be-4f2a-8eec-23369d1e7212", "sighting--fbe4b9f7-defe-4b97-96d5-fb8ac743b69a", "sighting--66e130ea-0379-40c6-b4ab-1eb8c0a22677", "sighting--ba9816fe-737e-473e-9cc2-406a95b0faab", "sighting--3d56bb6e-0ca3-4ace-95f2-a8a714f1c9a5", "sighting--621390b9-7188-47bd-b41e-fcbe05f87ecd", "sighting--323c74ae-ddf0-46e5-a13f-95e529fb7655", "sighting--1496381c-39c9-4191-a2d3-d61ed28b6885", "sighting--0cd47a84-15a4-4ce2-8cc4-5cf77311f6b9", "sighting--37c0de47-fed7-4863-86eb-5423ba8b1f11", "sighting--ab4c785d-3653-400f-8439-f4ed0c0111cb", "sighting--a690513b-401c-4452-ad1c-3f780e42e88d", "sighting--d08e7d42-f2b6-420b-9e13-599c73711380", "sighting--87721543-b701-404e-b541-eeb93cbf42e5", "sighting--fd9ac2b1-cf5e-45ba-8754-9026f269d8a8", "sighting--d864b0a4-23f6-43de-86cd-83232673e219", "sighting--73c77fe2-9f85-466f-87fa-06377332aed1", "sighting--c30c4300-1b35-4f1f-9b79-b4d19c0e7a88", "sighting--a8c0f270-89d8-4a6e-81ec-febb25ebc03f", "sighting--fc2b1fc2-7827-40e4-8a17-27f3a8584922", "sighting--40f00f10-9aac-433f-871c-b932aceb7aa5", "sighting--5966884a-7324-45bc-846f-fb624024488b", "sighting--0b3282b9-a865-47a4-8092-883a8c9e1ce9", "sighting--13ac241a-d7f8-448e-9b19-a23acdacc45d", "sighting--08e04645-2bc9-4990-89d5-391fcf1dde55", "sighting--75d8c060-2853-432e-a78a-737b3ed3e35e", "sighting--2bfd4a9e-4d8d-4e71-92dd-fa0ef8e0feb2", "sighting--391d51fc-ec78-4424-8780-25ee70d025da", "sighting--92c0afe3-1a94-485e-a36e-9f3a506d7993", "sighting--4a0f6e67-1f1d-423c-ba47-aaede4d3be27", "sighting--b6526d91-eeba-47ad-9ddb-b8cfb0c83282", "sighting--7691e046-195d-4728-bb6c-ed7774a3b331", "sighting--241457cb-0858-43bc-b3d7-591005af15dc", "sighting--0eb99704-877e-42e4-9838-1bb3f2c4de04", "sighting--745119e4-d88f-4cd8-9fc6-ea9277e619e3", "sighting--ba87dc08-e185-444d-836d-93bc33117a6a", "sighting--d9673c99-7346-46f2-9d86-4f1bd1681bc1", "sighting--aacb5d61-00dc-4d17-95e4-18174b356685", "sighting--584230ed-151c-4e26-84fd-a7c14adcd197", "sighting--bc94d92e-85dd-4f4a-aa6d-a49440ed802f", "sighting--8cfa9a98-e4e1-4ef7-a9df-213cbaad3a38", "sighting--309bc59c-15c1-441b-a179-7d822f7119f2", "sighting--a2e12886-b716-44f5-9eaf-d5d2d47a6109", "sighting--f06c2ebd-923d-4d51-bc43-6782d76cfd30", "sighting--ef5f7388-efdf-421a-9b57-82f3adec42a1", "sighting--63138870-e288-42a9-b715-fea5471d95d0", "sighting--e4ec1685-b6cb-4eda-97b4-a99c669e76c2", "sighting--67c968e9-7868-44cf-b357-0dd2f2fda49b", "sighting--d810d87f-18bf-4fc1-9523-90e52b21f9fe", "sighting--e6a9da77-ae90-4fd7-baf6-40a30148caee", "sighting--4b33db66-0d53-4819-8e07-9a57479f22a7", "sighting--f1e5be50-cbe3-4e49-b984-70c31849ae39", "sighting--ac402543-6eb0-4c81-b5a4-74637564ae04", "sighting--4118a3ec-1ac0-4afc-8414-e5703957d027", "sighting--613b541f-2762-4c0b-b0b0-b7c534fdfc4d", "sighting--0c1d8926-2a65-4560-88dd-5c88756ee030", "sighting--c40cd3d7-f1ed-4de6-ba3b-c0ff2131fa24", "sighting--1a021dcd-3ef8-49d7-8078-ba29a716f1a8", "sighting--675ee781-12aa-4281-b10c-c29121aa621c", "sighting--66da9022-299a-47bf-be87-a7a15f90f00c", "sighting--7592f8a1-3018-4f06-babe-d12a2f9e22d3", "sighting--4e5ca837-b469-4267-9d9d-501321ba4472", "sighting--79cd41dd-235b-4b66-8470-c124c64cb01d", "sighting--614ee420-82b1-4ee5-9cc5-3323f5d434ef", "sighting--de98b880-73e4-41f7-8f7a-eaf6ca81864c", "sighting--aaf73bc3-19db-4989-837d-212c50c7572c", "sighting--5689bf81-8690-43ef-b5f0-50eed590c849", "sighting--fbd4a6b9-2aa3-4dde-936d-66536c96b06f", "sighting--41c2a4e4-ac62-47ab-93e3-0a8dbf54de09", "sighting--e87bcf83-191e-4711-bc0c-db9ec6d5bf59", "sighting--9497ffee-398d-484d-8aa4-ca1b7cebd14e", "sighting--0b28befd-3451-48ae-81c1-b9d2b2274889", "sighting--e246f5b2-0e6f-46d7-8b32-f60e9213b93f", "sighting--70adc4c6-3ea6-4b96-a540-d10b10067078", "sighting--b7551a3d-14e4-45e9-8e7f-1747506a9808", "sighting--cc23f569-eba0-4fd3-bfbc-0091ff09b05c", "sighting--21545fea-6c64-4c99-828f-c10203f52296", "sighting--2bf7ae0b-5caa-4c06-8485-f49c79df60aa", "sighting--626cd666-5094-406d-88ad-08f6f6ca2bd6", "sighting--a5cbcec5-3315-4a0b-bc7f-89a329ea2524", "sighting--d5410e3f-423b-49f5-bf0d-c1f447f5f387", "sighting--35ad5d1a-8f28-4332-85d1-324760e87a6a", "sighting--6ad8ae3d-cab7-4528-81bb-cc36cc019884", "sighting--44791d31-e1cb-43d6-8ee3-8bbb540b8bcf", "sighting--71c13945-f33b-4cc5-8d69-390ff105eb75", "sighting--90062430-89e4-4170-8608-bc59b83efa89", "sighting--9a403271-14ba-4f53-a1b7-6dd47a8e5545", "sighting--62818ee5-d567-425b-a89b-73a6cb5fe8fc", "sighting--ce267ff9-4435-4aa6-885d-0973bcaed009", "sighting--8ad4fbe8-c45d-409b-b880-e1ac497dca41", "sighting--603451a0-0bcb-4c9b-99b1-f6c812ade9da", "sighting--e1235c43-2c28-4999-99f4-2b248f67b89c", "sighting--c08e0885-2317-4e0e-bc8e-56f5a22ed855", "sighting--439e2665-9df4-40fa-8803-0671cc43695f", "sighting--c35c18e5-214f-41d5-8a69-ead25fda7cc8", "sighting--c33756df-ec6e-4a12-9cb7-0922b3d23dc6", "sighting--97ed5744-5e72-4981-9274-a071fc564bac", "sighting--4b599742-d935-49f7-b325-d4b4cce6e76e", "sighting--5e1eb744-df54-4e8b-a72b-dafa616b0181", "sighting--698db23d-86f7-4f8e-adcc-2f0d89ab81d6", "sighting--3e4e90eb-1cb2-48a2-85fd-623f9034971a", "sighting--e9acd48b-0263-4b04-832f-49c322eba340", "sighting--f8e5ef5c-b6fd-41e9-855b-0e981209f31a", "sighting--0ed0ec5d-0327-455c-94aa-c0dc18808c46", "sighting--b55eb38d-4bbb-4d6f-bebc-30f0eec2a53b", "sighting--93d93211-5dec-44b6-abbe-e0894dad270e", "sighting--53296478-87c6-44c8-b4d4-5ed6323962f1", "sighting--68ef0f69-e3a6-4c1a-83a0-53ed2605a959", "sighting--1d5422e1-3659-4172-9eda-1c477db27806", "sighting--a2a396e5-da63-4500-9d20-98be2af1a0de", "sighting--19bcef20-de87-497e-840c-3c01bd9b0405", "sighting--4c67ba13-e4e5-40ca-b488-36a2090e461f", "sighting--0ef2b6f5-91ca-455a-bdba-4ff4c4ef1800", "sighting--f8669dda-a24e-414b-8ede-c9c2b4ed8c0b", "sighting--5ec3e6b7-77e1-473c-b9bd-4e4b2b2eb0db", "sighting--bc00617a-c94f-46b7-a981-63d00931306a", "sighting--0e3e4107-5d1c-4ddf-a42c-7a08f460fc4d", "sighting--c55fb2ee-8cbf-44b4-bfa9-1a4edb130fcf", "sighting--7ba47f2f-cdd7-4924-a674-7fe17eea732a", "sighting--8d871cb8-d093-4083-8a18-97e0b75c70d3", "sighting--007777dc-c67e-4cc5-a767-33e739a2226c", "sighting--3b08dc9f-e92c-42d6-81c5-54a5f122e4c2", "sighting--7219a0d7-ca16-4bd8-ae90-3ecb8f385d5e", "sighting--404142bd-a2db-494a-9900-736b5539dd52", "sighting--c4a7cdf6-8019-4604-aa31-8fc30f1e7bd2", "sighting--cbfbba39-c12b-47c5-b672-5076a7d7e10a", "sighting--aab53bb4-b75a-4f4e-98ea-e7a5b1aeeda7", "sighting--cecef870-ddc9-4160-862c-841720decd67", "sighting--70ebd07e-4cd1-4a12-b294-814ba7f16d44", "sighting--bcbcbb61-f917-4f08-ae62-24219aaf2d3d", "sighting--da8423cf-3a90-4a96-bc2b-9b2aca6bce08", "sighting--899f4898-376c-41ec-a1d6-8dbdb6c76be6", "sighting--65892dd3-b7ab-4163-9ef5-156f368ebfca", "sighting--fc2a07f8-c7bf-4121-9154-44b12c7fc270", "sighting--7e431101-5897-43b0-a4be-a49615e55cc0", "sighting--03cf28f2-e124-4546-a4e1-6de514e57241", "sighting--10654ff8-1a29-43ed-9388-9901804d510a", "sighting--14a65a03-5fbd-46fd-90a8-b055bb57180e", "sighting--12874641-b9b4-4a8a-a792-b71231a79b5e", "sighting--603513cb-a5db-4dac-ae92-59539fecd773", "sighting--73f80f45-efb9-41cf-b8a5-af11544906e9", "sighting--c5addf74-cbfc-4f83-a8dc-14c72bc75009", "sighting--c5c08ea0-5492-4fb4-8fa5-df92e8e4458b", "sighting--354b9e22-25d8-48f1-b7a1-2e1b9e3fd52d", "sighting--1efd8dba-c238-4254-a9fc-1a3ac277ddef", "sighting--3231d46b-1822-4189-be48-e5bbf05486f4", "sighting--d44e7015-4a5c-437f-9c65-9c3c5ad542dd", "sighting--b4bfb9c3-062a-425a-aca8-2a02b434dfa2", "sighting--0d289fc6-df65-4892-8649-fe5a91b2a73e", "sighting--f86549aa-efa5-4346-a79f-003232fbe3c6", "sighting--6bb52314-e90e-4255-aed0-7b7dfd4fba3f", "sighting--42103756-6f84-4fc4-a88e-b98ecca3fc0b", "sighting--37bd4de3-c978-4501-8984-a16d5fbb2fc8", "sighting--cc9a23bf-8185-49bc-a433-9649d6742002", "sighting--ec8e119e-9dbf-421d-afa8-38d0b45078b5", "sighting--09c4ccf3-663c-4702-9d7e-ed6b9dc4f447", "sighting--141162bd-bda8-40bb-8eb9-49f6bc944e0a", "sighting--eb0d8aed-b971-42b7-9ea1-556f8e93b14a", "sighting--5595cc15-7845-47bd-b1f0-7412cdf9f028", "sighting--235d7bcb-d07e-46b5-b715-fe87cbfb3e8f", "sighting--fe2c37db-a922-4824-af85-87a18c459a3a", "sighting--8c777887-cfc7-4233-8c18-31a585dbce79", "sighting--faeee112-7bc1-4d23-a807-4b31c335fb3d", "sighting--050f129c-21b4-410d-84d9-214ac6791b24", "sighting--90bbe6f2-3b50-4b50-b823-9c79fcb0155e", "sighting--59f5a37a-871c-41b3-970b-1142632fc601", "sighting--96d94567-c5d5-4b9a-b33d-dfa066a25c66", "sighting--9699b52c-08f3-4e34-88c5-a92f26825491", "sighting--cd003e72-1952-4412-98e8-beb456bf93ef", "sighting--7ad41bad-9426-43c9-b536-63b1ebd02c99", "sighting--37c8b50f-3d39-4b4f-b443-d9c67fddac2a", "sighting--c018d71a-f329-4709-a70c-81eb0373b113", "sighting--7b04ec35-3efe-464a-870a-87f6cbfe580f", "sighting--e42a58eb-6f90-4b0e-807f-acdcd6f1ba1e", "sighting--de5c301f-c258-4173-a4c1-68a0a1df69ab", "sighting--e290cab2-4e9d-4deb-86cd-a4f3c519e5fb", "sighting--791e5823-675c-41fe-a8e1-7fc98c4e7287", "sighting--9c385fc8-2a0a-42d9-9276-15d1d76484c7", "sighting--8092f8f7-10f4-4652-aa2e-da13bbb6461b", "sighting--a313d5e0-5b29-445f-ad1d-cb51ee419b21", "sighting--d07f387c-4a1c-400b-bf0d-43439452dbfe", "sighting--559d0d7d-79a4-47c1-9c1a-72a3cc2e5a5a", "sighting--13f92a10-8ff3-42d3-9643-934ed4b8ff1b", "sighting--35fb790a-ed6e-4559-b4b7-47b3fa17d53e", "sighting--a3841d8e-3134-4788-a43d-459362ebee3c", "sighting--43c1b1f4-fd0e-4a6c-9c0b-ac96817adae4", "sighting--3de8bad9-aea9-4ac9-8622-9733aa4181cd", "sighting--b0e0ce57-9c5a-486c-9b8a-eeeae14bc0b5", "sighting--415067ce-4dd1-4faf-9288-d01d2f0b833b", "sighting--d8fe89ec-8c4d-4da0-a09d-4f4c75413309", "sighting--58c3aad0-8cf5-4b32-ae6e-9922842320fd", "sighting--54fa077e-f0cc-4366-a429-8a84c4e20673", "sighting--8b1dcb73-b8cf-48f8-9d9e-ff675be37c09", "sighting--d3306b97-0f73-47a7-92db-773a2ea373a8", "sighting--a34a1143-d012-4b67-9b66-0a04ac0ec50d", "sighting--d0d95ed3-19ec-4625-ba1c-e96a1a79065e", "sighting--33d8fde6-cbe7-4218-a09e-cee935594215", "sighting--939db58f-ce0c-4765-a3cf-0f3113cf9e28", "sighting--2a2f3968-e7e5-4e9a-924b-3e6b5bd072a2", "sighting--b8be78b4-7328-4f37-8028-23979e72e98e", "sighting--85ceb8e8-524a-4782-9b3e-e71ac85d01b9", "sighting--12ac4204-ae82-429d-86bc-06ebbc62c5f6", "sighting--689fdf06-b700-4a71-88ab-7c0a1ea4ffdd", "sighting--e20169e3-f48a-45ba-bb21-1c0356726854", "sighting--fa760d93-e844-4934-978c-44bc932042a4", "sighting--7062a3ab-5177-4e6d-85eb-3a98658fab26", "sighting--6a79b198-bacb-4906-91eb-f231e3d194c3", "sighting--36ec8a50-22cd-4795-ad3c-c9c97783a2cc", "sighting--d3654f7a-3dc1-4f6e-8e7f-1748abff0eef", "sighting--df2e12ef-859c-4aeb-ad95-508c31d07ddb", "sighting--4b45856f-01a8-486d-bf24-d02cbb853668", "sighting--e69898d5-0068-4bd6-96c4-ae878b56653f", "sighting--7b40bfe4-de28-4d9f-8667-45d5cfcbec61", "sighting--09c61b6b-e471-4b73-874a-972b22098aad", "sighting--ec009633-8274-4260-9178-2f18f4df8b60", "sighting--181fb3c9-631b-4a4e-b556-b4af030b9054", "sighting--49543c14-7576-45db-a3b7-51b70fc06f56", "sighting--5c019847-b4bf-4bfc-b783-f09990be0678", "sighting--ec81f3d9-ec88-4c5c-b674-4e2232fba813", "sighting--3dbfa84d-5b92-475d-992b-371c91d893cf", "sighting--3c293d92-2bb6-4008-b73d-0d3f6e104322", "sighting--81678c96-dd1a-4a64-9414-0020168f8c50", "sighting--36c15155-7957-4ee6-9273-d0b64fee716b", "sighting--e7dbe285-52a1-4e71-8e67-c3d06729af4a", "sighting--c16c3d72-cc4b-4956-85ba-7659694480b2", "sighting--fad1b4cd-b0ef-4b0a-a83d-7522614673a2", "sighting--acbcc716-f3fc-412f-b1dd-c730b876eed5", "sighting--675fad0a-661f-4c36-a567-fd59b0a5ab22", "sighting--0cbe886e-647b-49ac-af68-109dd7ab0673", "sighting--da86fd80-3463-4a1c-b8a5-6b7bbc88b10b", "sighting--3434d469-75bc-4dd6-9c9e-ef3560b6dccc", "sighting--a011f97a-6016-4c86-b9ad-a4fd32dab5a6", "sighting--b5cedc41-8587-4fea-83dd-b786d8ed1a0f", "sighting--43f017f5-dd9f-4fa8-9332-1e26a6860c6d", "sighting--bc039525-e5ab-4701-811b-c38a7a3059af", "sighting--503d97c8-2d60-4d5c-9840-2dd18652a6ba", "sighting--50f4bafe-d51c-4bcb-ba3c-9c70570258ed", "sighting--9939f44e-008e-4ccd-9f45-89ae87d20be0", "sighting--aa016e6a-96ce-448a-b4d9-4570c2925886", "sighting--7beaefd0-0025-44be-a340-be9cb3e736ed", "sighting--7c3d0fdd-f2ef-49ff-937b-f216c01e146b", "sighting--5210703b-dbbc-4844-a637-cfb7237f32bd", "sighting--9b5c0478-524d-4296-8061-b281e138042c", "sighting--61177482-ce81-43bd-960a-cc393378a1b8", "sighting--66011c74-b5c2-4b12-85ba-d8fdbfc986dc", "sighting--535033c1-6687-411e-8e7f-91596375d190", "sighting--13f5bd03-7183-4f10-a889-2d5cefffe254", "sighting--f0038987-6c4a-4d2a-bf65-1b1ac7e42989", "sighting--71f73d9c-9cc8-4009-82dc-058fefd1618c", "sighting--29e7a55b-e0a2-4dbd-ab4a-2f75626ab2b3", "sighting--6fb2ae7d-57a1-41eb-ad68-74829806935b", "sighting--eb4edd57-66d7-45b9-9b72-4385d3ca3fa2", "sighting--db9b9cb3-98ed-422b-877c-25309704571b", "sighting--43300f8d-5222-41a0-aa3b-56f5c3fdc0f6", "sighting--08d9f496-c131-4ff2-8ced-8b6669469d43", "sighting--b205c55c-003c-455c-83d0-7dd1e6dcca98", "sighting--946bdb27-c68a-4291-bda5-45fd5c7d3727", "sighting--38da5476-d5ac-4cea-82ab-fb3d0b3cd0ba"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-09-21T11:00:02.976Z", "modified": "2026-09-21T11:00:02.976Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}