{"type": "bundle", "id": "bundle--a0686f0d-6d71-42e8-9041-c1808f2279ff", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--e87cc564-5c89-4d25-89bb-d490d876a872", "name": "Reverse Proxy (Perth)", "latitude": -31.9505, "longitude": 115.8605, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--d6a19120-6b83-4b32-bce3-2e32340b0449", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--3b8cfb57-49d0-4656-bbf2-8322736e9490", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--de9be1ea-bd15-489d-b9de-006fb4a34143", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--a58f011c-4b1f-4b61-9a9a-3c619246eeb8", "name": "Reverse Proxy (Perth)", "infrastructure_types": ["firewall"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6fac519-7645-4432-a181-6f3b9e6de6b1", "relationship_type": "located-at", "source_ref": "infrastructure--a58f011c-4b1f-4b61-9a9a-3c619246eeb8", "target_ref": "location--e87cc564-5c89-4d25-89bb-d490d876a872", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--3769db15-f502-451a-b20f-efa2200da10d", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--000afceb-ff92-4d80-8434-3a96113fc78d", "relationship_type": "located-at", "source_ref": "infrastructure--3769db15-f502-451a-b20f-efa2200da10d", "target_ref": "location--d6a19120-6b83-4b32-bce3-2e32340b0449", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--b1fa8223-720f-4609-966c-aa8ad20d832c", "name": "CVE-2000-0868", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-0868", "external_id": "CVE-2000-0868"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "name": "CVE-2002-1149", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--b374f560-b416-4f5f-ac00-07123cb91230", "name": "CVE-2016-0061", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0061", "external_id": "CVE-2016-0061"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--783eaf01-1f68-486c-9e37-4a241bae87ec", "name": "CVE-2019-0193", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--43644ded-6511-4e24-9784-f2a53bc94180", "name": "CVE-2019-19781", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19781", "external_id": "CVE-2019-19781"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--aa103677-613b-4076-b298-c5869231420c", "name": "CVE-2020-5902", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5902", "external_id": "CVE-2020-5902"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--cceee095-1214-46a6-b5b5-d2e205f87c06", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--36cfbfbb-2e64-4786-9fc8-eddaccba8c36", "name": "CVE-2021-34473", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--21e79671-997f-4230-8d54-031cd20c2a30", "name": "CVE-2022-1388", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1388", "external_id": "CVE-2022-1388"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "name": "CVE-2022-22274", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "name": "CVE-2022-22947", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--92c2dcbb-4629-4c79-89ae-52aa5624e7f0", "name": "CVE-2022-22965", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965", "external_id": "CVE-2022-22965"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "name": "CVE-2023-0656", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--0ad984bb-fc79-41fc-9866-07b36e5471b6", "name": "CVE-2023-46747", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46747", "external_id": "CVE-2023-46747"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--7ab1b8e2-0e68-4add-8d99-3c5f05b19be9", "name": "CVE-2026-9198", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "external_id": "CVE-2026-9198"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "name": "Network Service Scanning", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046/", "external_id": "T1046"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6ae2a860-f20b-4055-823d-4e7a9028965d", "name": "Exploit Public-Facing Application", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190/", "external_id": "T1190"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "name": "Credentials in Files", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001/", "external_id": "T1552.001"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "name": "Cloud Instance Metadata API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/005/", "external_id": "T1552.005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--982b846d-1095-4d39-bea2-cf3e5eb7a9d9", "name": "Container API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/007/", "external_id": "T1552.007"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c788e90-d30f-4966-a4e8-384c043bc91f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.171.122.39']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fa3ee1d-0735-4b7d-9f8f-fe755ca050e0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.232.85.189']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee593410-b324-4487-adeb-9f4c6be1d73c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.238.92.60']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62065999-9c75-49b6-8950-f57d90cfc5fe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.34.28.195']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4c3ac97-d34b-4622-b89f-03666d6f61d7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.183.195.206']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c323bc26-ba4d-4422-b7cb-139e8ff2efe7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.208.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed528ce-c40b-449f-a169-cd3177584067", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.25.53']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d368e9c-fac5-4b62-be04-d7627e59e62a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.26.245']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--310d37b1-764d-47b6-8b7a-39ae3b3d1b72", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.78.193.166']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--115953e6-a765-4e10-a5ef-503e15c7b449", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.210.148.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36452deb-3088-462c-b4b2-0c4742e23e94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.213.48.62']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9204065b-55ff-4128-b919-d402fa6a888c", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.54.245.241']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87a6e2c5-148b-4da6-a8a1-48825de7d00a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.89.33.82']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ca16a1d-e7cc-4e5f-a410-8661e4c2167a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.10.87.52']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cfb910c-bc2e-4ea6-b73e-d232ee195a4d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.131.61.226']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bbfebc0-1bdd-45b6-bca2-89f909e49e0f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.139.193.182']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1337c3dd-77ab-4bb9-b9be-ca5b24cb66c3", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.230']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da31cc5-6030-4f57-be1f-27ec148f8252", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.184.180.172']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aefcddc-f63c-4792-af61-15c86e0d7ae5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.1.91']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a487ba2-7403-4b33-ab1c-3a39075cbc21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.186.52.30']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3349855-19fa-472f-9e40-46ad10a27957", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.188.92.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc86e0d-fe04-40b1-81b9-77ce71238e3f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.189.217.170']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe8edd9b-ff34-4010-9fb0-da2de6ddf5ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.199.111.104']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8d3911a-a4ca-4c97-a2e1-4dc693c35b7d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.51.133.111']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72ef60a8-7403-46e5-a91e-a20f61328bba", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.54.67']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e35913-ecb5-49a0-9a9b-ad3e938f26a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.77.3.158']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6105da02-bcce-4559-9680-2762c80a6293", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.80.126']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '104.196.165.31']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b54ec8da-ad48-4fe1-8fe9-799958e7a494", "relationship_type": "indicates", "source_ref": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--89071d3c-35a6-4924-9b94-9e19f9d8cff7", "relationship_type": "indicates", "source_ref": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c55f0ad1-abb8-4578-a660-3564f6013135", "relationship_type": "indicates", "source_ref": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--13901d4c-3697-4f34-9304-bbd603a19ade", "relationship_type": "indicates", "source_ref": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5a314e1a-1de6-4f2f-9516-98e232b20f0c", "relationship_type": "indicates", "source_ref": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64a5ce77-e3ef-4b61-8c59-d2898673e664", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.218.166.62']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c35ccc-d906-417f-892d-f3a376d30f92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.234.19.132']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89af7f33-8129-4252-a746-8631320d064a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.68.24']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31dc1bb2-3e06-44a6-b576-926a38f55555", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.40.207']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76893952-26df-4804-9956-2c3072e508a1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.145.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bcd400f-6a2f-45f1-afaa-74c6e280f14a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.233.73']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aac4a3c2-1ad9-49ef-8c2e-9e9785021bd2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.117.5.137']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c92c47c-3b1a-46d4-beec-7a73b1a69ab0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.107.236.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabe3166-a141-44da-97c1-6027326399a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.52.171.40']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--078ef465-8c6d-46c3-b4c1-d70ec56feca5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.191.213.144']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed28e64-d1ee-4ad3-a100-4fba92650da5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.85.155.162']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec7fb4d7-775b-4681-b0c5-f3ab43c13d61", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.130.221.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--838f8d5b-5ed3-4eb3-bba5-5834290e4936", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.133.102.41']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3dbc91f-99dd-4b36-a61a-475788268aae", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.15.169.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd52c18-5026-4950-965e-285c5b7ac1ff", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.111']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2df0ae6d-4b4f-4010-853f-d609ef657ed2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.117']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aad4bba-6d48-4967-a199-07258e1f54cc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd4c0f4-bffe-4c58-a78e-0d0fa3355dce", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--978abfe3-5aa9-418d-87c4-9830be7bddb8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.171']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9ffcd81-63df-4234-9e70-50ec3b7d647a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.26.222.117']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11da9674-6270-44db-ba98-697041210795", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.11.134.249']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2772999-de90-4470-9f86-73c48acd65e8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.92.157.233']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb88843d-6110-41f8-beba-bb9e7eebb9b7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.119.142.10']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a8cb174-cc53-4e61-830c-cbff9f809a48", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.162.18.150']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cff31d8-62c8-4d2f-ac75-49d3af16354b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.51']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77180521-08c4-454f-8991-09f4e96685de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.190.155.235']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3544395-2a00-40dd-8250-433d0d6b2e66", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.240.110.90']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53804c2-db0b-42b3-b4ed-ae978cd06409", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.128.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0176a5-93f1-42dd-a0f2-d200ac1bea72", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.129.218']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229701df-1415-4276-a98c-bb0a30eb78a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.130.147']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be07f34d-e486-4fda-9fd4-5c065953223b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.248']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57fb28cf-8b2c-4897-a0e0-04483c9301d7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.90']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9f4478d-1294-42c3-a9c1-503711c290fa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.98']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b04a7fb-35b9-45d3-98b2-e131b8644ded", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.215']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec9d70bc-fd57-483d-94a9-d1c62ad15783", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.64']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac13b3e-9c91-4113-94e6-aa356a61cb5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.174']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e5fb8d5-6743-43af-af2a-fe4dcb706f43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7084dc4-e0b5-4588-a40c-7fcff8b28d2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41dab32e-17ff-4f6c-af20-c36f4344a7f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.238']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b6c8e8e-2b2b-48e5-8eb3-baf32ebbb8bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1700e3f2-1945-4768-a4ae-bc5dbcd47ead", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.133']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93eab4cd-9d77-4455-8d2a-d3df493a7d63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.137']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1217b78-1d39-4b70-a4f3-5a020fbcb988", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f61417-cd0d-415e-b7f2-e8a48e84dca3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.250']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--688efdae-2d48-4d61-8962-6ee142de030c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48807465-9812-4eb1-b786-b2b972fb53f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.144.179']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--946162f3-7841-4ff6-91af-4d1411ebefdb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.144.38']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a796800-d2e7-4851-9f1f-2e2a1f56ac92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.147.113']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3950cb7-9e67-4f3e-9601-ca70872a76a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.222']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efec14b6-cfa7-47c0-8517-0ac804c4a52a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.140']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa90475c-7500-490f-9dbe-9af3dc5f4417", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1fd99b-3628-4247-80a6-861875e2ab4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eed1065-d72f-4fc9-9efa-febfa2f6c90b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69eb5c4a-c619-4327-8136-f8718f5254ab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3769f2cc-54ad-4ea3-af84-38a7be8a2dd1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.118']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--383c9bcc-70c5-4c34-a2b3-25111bdd3fe6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0aa0eb-9a2b-4fac-b81e-1c275764addc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.118']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92249c03-b843-46a8-8f46-f2a129f683cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.145']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d047075-0a31-4dcf-a839-d211697cc501", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a1ee3e-12ba-41a8-ae03-24586d8665be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.250']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b88f0f2-2d87-4cbb-82f9-ad4723a0eb97", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c49a220d-4c92-46bd-b036-70fbdb1d4b7d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1355c492-51f0-4099-b0a1-2eb5d612db15", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.190.9.86']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b3b389-65ce-4891-a744-d4a01f628c50", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.32.223.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0103362a-51de-4eec-ab05-6045808b62a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.33.68.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee04f536-5e66-43ed-9749-327393b1fc09", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.34.177.159']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f03025b2-11af-46ea-bd6a-e43778e64eb3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.242.207']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85886315-f345-4d46-8fb1-1b2a1591f773", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.44.29.73']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19cf0cc-f484-4db2-9047-c89771b3ef6a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.45.141.243']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdeb54a3-9941-46e9-bd95-6d3acf7980da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.128.94.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50eec09a-4cb2-491f-8b0b-9329a41ad1f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.133.131.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e45c91-46a6-4541-986f-a928d94f602b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.191.23.165']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee87b866-e839-439c-ba8a-003a505ccbc0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.20.193.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3100041a-12de-4692-acee-3d7d6f590571", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.23.43.37']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--186d9956-4813-4cc0-8ab7-d6457313ba81", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.74.194.231']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac6f0b9f-ca3a-4877-b12c-fe1141978a54", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.78.237.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87beede6-491a-474a-b8a2-21fe7f6650d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.78.73.96']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088e50b5-a9e1-48fb-b6b7-f7d956228a5e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.79.5.111']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f03c3be3-db60-4d3d-941c-c050a792f510", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17497023-7512-490f-bf58-b8db6f39388c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.167']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aabc7df3-89f6-4a83-a787-bffd41249b8b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.206.193.44']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac75f9ea-ec6f-4b2f-908f-5df97769f6e1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.240.181.51']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e41abdea-59dc-4127-865b-40b1cf4f9979", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.3.227.80']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2900474-e1df-4b55-9914-3d26fe724d4b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.6.44.221']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ade3a4ea-ac39-408a-bcd0-049be4d01829", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.142.71.122']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c21403-7a11-4b9e-a1d4-424d2ee92d63", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.45.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdaf1bd8-f609-4a77-a543-ad3c08c6551f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.36.30.165']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a96d8e07-662a-49ff-a8da-4bd27ac35b0d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.38.44.223']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41a9d5be-a741-40f4-a966-bc1d13ebb01e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.41.95.47']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11d38535-250a-4907-8754-f7a974ec0d44", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.45.90.91']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3aa7ea4-6bec-4387-ab35-28a0bf9bfefc", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.74.238.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a0df9f1-2458-4ecd-9388-fb202f70adde", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.207.119.167']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c69791-5e57-4e8f-a9d5-9f5dcf8b6be7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.208.180.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9f19656-fcc0-4090-9152-6a3768657702", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.91.20.139']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5c8fc3-303f-466b-8ad4-f64649c03f39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.176.104']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a46c4b-719a-4a4e-96fb-964301dd6981", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.122.72.27']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5da5154-aa57-4d23-abcf-0f3af6f74f7e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.135.193.207']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ca7b882-a992-4bd3-94d4-ca5386611554", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.152.193.222']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d58ae46-489c-4f1a-be10-7bb423c55a44", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.155.162.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a645dd3a-6bce-4411-9ed6-2787ad05d370", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.163.58.17']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68369a59-63d1-4bcb-98b9-8299d8214153", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.169.23.2']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d47c7e50-e9e4-44d7-abdf-94a17383f430", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.175.35.42']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5681c976-f32a-4dd4-842b-94912f72d238", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.181.204.95']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea56f262-225b-4dd0-8d20-88440454e6ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.229.156.34']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d685ff9-c1b9-45d6-8939-015f12f57c7b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.116.213.28']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99f61efd-c4d4-4e55-be4f-329be12c1b51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.2.52.220']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d29ed995-1f2c-4e04-8a57-71d387b0ea4f", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.138.18.10']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884a8b06-d5d0-46f3-b34b-861f8da61f3c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.193.198.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac3b360-13ff-47db-8efe-47701df03403", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.202.34.251']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cbea82d-2984-4c6f-9506-165ead21e63c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.252.118.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a97575e5-1b7e-4053-a912-92a7e95a790d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.131.68.204']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b4200ae-492e-422b-af03-14677e9567b8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.228.91.149']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d0776a-1605-44c1-a5f6-6f84f702ffeb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.236.228.164']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--167b3b57-ee03-435e-9ab9-760f1b39c401", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.9.159.94']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d82a5dc0-7719-4d23-86fd-d6f50c3c269e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.201.83.187']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2be9c84-22ff-4253-bfb0-d8a7d8eba858", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.65.194.209']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf523495-19b6-44f1-bf64-806dcf71b997", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.117.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44546e43-4fb7-4022-8e4d-bdffa5c26ccb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.82.186']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711f7267-7850-45ac-9662-ef0a8cabf191", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.70.107.184']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f944aff7-9ef9-472b-80f3-9366e47d572b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.94.99.47']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb1ea2a3-433d-41a1-9940-c24a16df36f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.221.202.181']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--888c2c81-18ee-49e9-977f-ac8d67a40825", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.145.115.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2cc45fd-85a4-445d-8b25-df6af8e6e342", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.127.188']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6cc1426e-ca5a-483f-90a6-e85812e6a982", "relationship_type": "indicates", "source_ref": "indicator--b2cc45fd-85a4-445d-8b25-df6af8e6e342", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f502ebf-a6c4-4728-87ae-9b9f07f7dbe2", "relationship_type": "indicates", "source_ref": "indicator--b2cc45fd-85a4-445d-8b25-df6af8e6e342", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49583b2e-5061-4d3d-adf2-a88d87f59677", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.148.29.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4ff66c-3f4a-4707-aef8-70ce63abdf78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.0.73.113']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.107.210.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--15ee3d10-7c8f-46f2-a364-74418024f33e", "relationship_type": "indicates", "source_ref": "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a71d26b1-16fb-43e1-840e-9b1a2ba285d5", "relationship_type": "indicates", "source_ref": "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5811c189-02f6-45e4-9b5e-7fb47d2b9294", "relationship_type": "indicates", "source_ref": "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e8b465-d70a-45f7-8fe5-f9e97e2d7848", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.108.36.45']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.85.32.33']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--77cb708c-7786-4feb-a70f-66db2cbf19fe", "relationship_type": "indicates", "source_ref": "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f7a8770-937c-4cc6-83b5-0750e4715577", "relationship_type": "indicates", "source_ref": "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31dbaf37-0305-48cd-96d2-6e2f15deab13", "relationship_type": "indicates", "source_ref": "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4c19b5-8f60-4e95-847c-ac2a98102392", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.85.85.238']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0668c9ef-e599-4ad6-9ec4-e55cc3b2d58f", "relationship_type": "indicates", "source_ref": "indicator--4f4c19b5-8f60-4e95-847c-ac2a98102392", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f0adcdd7-e297-44f0-867b-5d6ee2d8041f", "relationship_type": "indicates", "source_ref": "indicator--4f4c19b5-8f60-4e95-847c-ac2a98102392", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.86.171.84']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f2d21443-0a55-4cd0-9741-db9d2fd91563", "relationship_type": "indicates", "source_ref": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6c0ba157-723c-4ac8-906f-02e6769a2005", "relationship_type": "indicates", "source_ref": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0171ffcc-b517-45f7-9c2e-200b682714e6", "relationship_type": "indicates", "source_ref": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b61a3b58-42f3-4b73-a92e-b1ee5c9bec9d", "relationship_type": "indicates", "source_ref": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--48c4753c-09e2-461d-9e28-02bbe52eb220", "relationship_type": "indicates", "source_ref": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2036033f-197c-4623-b22e-45e346a5dd44", "name": "Malicious Host", "description": "Observed: OPENCLAW, WEB activity. Sensors: cfglobal, openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.90.55.249']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:openclawglobal", "protocol:openclaw", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aba526e3-6ed3-40ce-943a-346b68c25b60", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.90.88.88']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c6633c-ac95-4ecf-a490-d244c183f618", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.108.98']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be04f8a8-51fc-4402-80a7-ead21073747a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.118.68.246']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--323e10dd-3205-4611-957d-ef9c2a98add7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.199.60.26']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea7ba9a1-8a23-46fd-9923-1614ff63dc22", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.99.53.121']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e825016-d1f9-4612-84e7-49f6e1d1a111", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.138.115']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4386b2f0-6f72-4b32-b772-b29a7a6495e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.40.193']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1944a50-5ffa-45c5-925b-9616f3a79d15", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.43.190']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88dc3797-60d3-41e4-90c8-9851a70d9336", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.155.134.17']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089e16a1-aaa0-498f-8188-43a998571ee1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.19.117.131']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356f2393-326c-4e85-acc8-e50c146e7a0c", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '139.28.219.68']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98549d47-e451-43af-a804-05c481b7b06f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.208.225']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dadc0f2f-db3b-44e5-a221-9cbd95fd39df", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.109.229.145']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9024cb3-d832-4cf2-8709-60a39f067ede", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.136.118.142']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--844f103c-a07e-4f28-bf50-7336be53f305", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.173.212.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7ba933b-69d8-4b8e-b7f2-d65f2b16352e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.19.139.114']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3059fab-2be2-4a23-a51a-2f649786de7c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.191.167.147']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b88f85-d851-439e-b09c-6f23c08a1ca7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.231.232.177']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29625a5e-f312-4451-ad47-4b7e3893454e", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.241.172.84']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a132b640-10a7-4876-a5c3-41e8688b0262", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.35.102.62']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803c5bc8-bd50-4ff7-94b4-04fdda3d156a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.41.13.136']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc249ae0-22f6-4235-9a4e-113e14e0a6a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.50.37.159']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a69120-7df9-4cfa-8d8d-09e90a29b9f7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.52.49.234']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbcd9aa7-e67a-4eed-a2ff-7f593d1fe6d3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.116.66.109']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38fa3797-bec0-4f26-92e2-02458b005a76", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.126.95.64']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a236e0bd-f121-41a6-972a-98eed1cec8f2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.56.186.133']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--164b5587-8add-4a7b-a080-54d413a7cbb8", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '141.95.159.188']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db0cba17-68db-4af2-a2ca-55cf5402a8ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.137.45.191']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b53fc4-959c-400e-92fe-d978bf0d387d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.6.15.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a003115-5316-4e39-8cee-d7cefff29518", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.153.30']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1287eb-38f2-4d73-9f4f-46356832f6fa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.60.93.19']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a78a4af0-75a2-4dde-97a4-15a5e9158079", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.194.254']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6377c35d-82db-4868-a047-aa3a71793f25", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.86.146.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b38ba26-c092-419d-a30b-99394f785617", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.212.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f306f882-c918-4a19-b0c1-758e38e25312", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.100']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abbce5b6-3eaf-41d7-9e8d-39378a07b7c6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.51']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--698ab6fe-01e8-455e-9cd1-534671cc26c9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.213.1.99']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7367555-a863-4b7f-b02f-5368c51e3a15", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.50.231.135']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5554e558-c4a3-4396-abc4-94b6430c4232", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.40.50.220']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--445ad131-6df5-4528-8ae1-f3a6e4c056e9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.50.208.196']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a985f0-160d-40e5-8f1f-50e4c2dbcc7a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.6.178']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00fe555e-7780-4d4e-a625-ba60005c9234", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.40.242.182']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--258aebae-92be-40b7-b7fd-ac4e4d6629df", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.11.122']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcce8ab3-dc2b-4bdb-a2e4-d92429c4f369", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.133.185']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7703dfae-c63b-4e15-8e64-387d8716a3c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.134.132']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e141c707-cbcd-4f61-8ccf-131dcc72cc47", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.186.215.156']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41426ffd-5ac7-48f7-9b80-ac5f6de59212", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.247.51.240']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--119abf12-3693-4287-a64a-2b84733a6b18", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.248.85.236']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e567e75a-8686-49a1-85ad-27d9d9321b30", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.58.141.224']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afcb6afa-1d48-4d6e-ab15-c337c5c2ca82", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.171.59.106']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e415b02e-b829-4272-aa76-e57d2705dd28", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.236.14.117']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa9cd34e-f635-4e19-af91-984ef46e61cf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.34.174']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4189942-4ac6-4c15-ab7c-e1a427b51736", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.27.139.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229c42eb-2aa2-40a6-8142-a6003e51a4c3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.42.4.29']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16cb137c-3f67-41ff-87e4-91c6a00906ff", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.229.21.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04a16b24-c87f-42ea-b7a3-c9e7d73300e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.67.81.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--023a800a-a773-47a7-8481-def6e070027e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.85.206.190']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89d3336-1933-448b-a69a-7fe3271885c4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.173.89.43']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47d4523d-be4b-4d6a-9ba1-0ff4ea145736", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.34.88']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af188c9-853a-4227-aa6f-561799689aa2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.95.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d9ab52-8aff-4c12-a051-0c1b840a2ceb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.205.128']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f18e4164-858f-42ac-95d6-d6c37d7726db", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.124.112']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66161ed0-01d7-4517-bf1f-b68a5ceaf006", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.127']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d67681e-aeb6-4656-b56d-9aed82508312", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.250.114.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5680db9-d241-463c-b6da-6ceb155aba64", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.51.212.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7190eb2-9fb7-485a-990d-c05f28f16f51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.14.66.219']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71b4b33d-3c1c-4933-a026-e31296530fb5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.14.81.106']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ace3eac5-4553-4ce4-89c1-5b2e5e752b51", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.191.218.138']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9712d67e-9721-461e-a3f2-2ce5fd7cb421", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.206.172.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ec4d630-ac6d-4c6f-88df-b20c3c848f88", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.217.103.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--948d4b51-c735-4bed-bdb9-8b6ccd7bef28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.222.203.72']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb83ee7-2f6e-4a35-bbfb-123ef5075139", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.52.103']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51757a27-99cf-48eb-9541-c3970031696d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.12.88']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c065683c-3232-489d-a98b-c94f9c3ccd3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.14.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef4abf8-6ca8-4253-bb6a-6bcc3a7ba4f7", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.104.235']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb50461c-138f-4386-8dc5-01d1aba09e1c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.187.159']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083e3334-dae8-46e2-8966-eb188950b5c4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.126.6.183']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba9a0da-a6df-4abc-bc86-0e4c173cf993", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.249.129.143']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f6f9d3f-5b77-4c06-a1ef-e92a29eaa0e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.202.173']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--351f360a-ea8f-47f8-a9c2-bf68836280d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.70.105']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569157d0-9b2c-4775-a8b9-8935628cb5de", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.131.93.157']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18073e8c-f50a-4253-b293-e1782feadb45", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.167.228.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cb7ad2e-b57b-47a7-b532-81cd1012190f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.196.85.249']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59ea395-3341-4ade-8785-d78b38f3f39e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.40.142.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ba7eb71-5934-40b3-bf1b-824b5a6ba52b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.58.216.97']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f715c93-45df-4a1a-a69f-99b170bddd54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.113.235']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f53b7ee0-2394-4662-93c8-48b1a7358eb2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.163.201']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c87164f1-0f5e-4ff8-814c-6f46421cc5cd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.75.254']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72cfeeaf-47a7-48e2-bb3f-8f16e06c89ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.254.202.197']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37bfb5ce-dd2a-4bd3-8225-bd9772c15671", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.184.217']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f33f2592-9247-47a9-86cb-4d80fff594c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.201.80']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b4d59b-d74c-4e42-9e32-43bd04c12d95", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.96.231.125']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db32d76f-fe47-4855-b70c-99dbaacbd879", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.200']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b43c0fe9-7dc2-43b4-94d4-658d863f1f52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.210.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38b9b0b6-75c0-4b1f-b88d-8b1042e7c005", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.181.72.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71dfaf13-d2d0-41b3-8181-17a463aebbf2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.238.197.153']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e33f3cc3-d34d-4aad-925f-ba6efddf14a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.213.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aa646f6-32d2-456d-a84d-e5bbb4364303", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.100.88.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bda201c7-9255-444a-8e5f-a18449173237", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.137.117.172']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ce1e3c-516f-4354-a431-b01b73b347dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.142.58.225']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73557fbb-b0be-4ed0-87ae-fc9fbbd5c69a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.193.206.234']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08d5e059-c658-4fa3-8119-2277cdcc3cb7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.204.179.27']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e839bc71-4fc7-49f5-8a26-b8aff6b425d8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.205.116.37']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de7c142-7aba-46f9-8cad-4fa3d453f575", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.209.216.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c97e9e0-64d9-4381-a0ce-a2b8a4e7242b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.210.254.98']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffe4111a-94df-4dbd-a455-fc933729ab1f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.145.234']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b8a35e-8926-4759-9de5-cbc65b5a7b17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.163.171']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31b37a27-45fb-4e39-b78b-eccab634b27c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.126.50.42']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0012bbe1-a5a7-4a04-ac60-1485c06a6e93", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.144.219.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61cec9b4-376a-4bd9-9235-057dbead7e87", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.148.60.160']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0decade4-23ed-4bb5-9c1a-b9f27eb7ad86", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.232.198.148']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2965667d-3dcb-467f-a949-8b7991dbf741", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.233.66.218']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e36a76-87e5-4aa5-aaa1-523d3b3ca5db", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.28.140.166']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17f9d74a-2b2d-43cb-963d-018561eb02dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.29.153.107']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--427c8bcf-f5a6-402d-bc2b-909fe8d08156", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.36.149.167']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e624285b-ab63-43ec-8e02-5d7bd695b268", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8181b15-8987-4270-82ac-1ec1ba0e1c40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.12.210.249']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f84989b-faf5-48ba-8c7c-d60946ec3dab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.204.33.245']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e073a40-f960-48be-b4dc-8712a92b0f1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.22.173.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bada8cd2-6eb7-4d19-8ead-bc90f5e820a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.37.58.0']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcd72caa-a482-4f3b-a427-8ec8382e988f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.118.93.222']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b6e7345-14a0-477e-bfb2-2c32dc67c83f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.192.75.58']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d17ddf9-7912-45d3-a6f5-643996f0ed4d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.251.111.89']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5488260c-0cca-4082-bf58-55894d1c88a1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.26.195.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff16cd1-eac7-4d31-8536-ca8b15ca5f61", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.126.184']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e4e025b-19af-49bf-a50a-e070497758f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.73.241.171']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58aba91-a1f5-4e52-b8ac-cb8e6ecd69c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.228.48.145']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ddd19fa-cce3-45f2-bf41-654b570c03c9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.134.194']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f13347a-207d-4c26-b986-f13e4339a7d1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.167.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a46f64a-dd46-407e-b8fc-baef6ea4db1a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.163.28.55']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2248ed3-3b99-4d47-a9c6-505655a22c48", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.176.255.100']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc8d631-c1b9-4c3e-9076-3cd84977f6d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.183.26.197']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884d893c-897d-4e7b-a586-b708cbdc5f70", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.233.177']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788f31af-4fac-41f4-b192-6ca862036c8b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.97.104']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a496add7-78c9-476e-b28a-9db6724b576f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.94.170.112']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4171973-cf9c-44f5-924c-45059e9dbb2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.14.255.154']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d793f1dd-5268-4b86-9bcf-439cfb0a016d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.191.143.55']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1537f061-2b10-40bb-9618-484ce452f2e7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.220.176.117']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7109b19-e081-491b-9e32-8400814f3938", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.49.130.99']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fc5e88b-9fff-470e-ac62-71193f51b954", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.190.172.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--716b1800-a5e8-40d2-8ffc-7898b671d613", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.44.73.149']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa42718a-34c5-4cbf-a60b-48579d0cf5e2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.53.142.133']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0933d634-95d6-49ea-8cae-360c19879560", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.93.50.90']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fe2c895-e721-45ef-8b93-1c51fa41d44d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.101.39.240']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c47d565-63b2-4fe9-9f9e-2bb7af3724aa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.108.127.86']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a54924c-f1e9-41f7-8257-dfbb9c1a98c9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.112.17.96']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b73ba3d-ba69-4759-b22b-f9df2f9cece6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.179.136.244']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e14e5b76-f995-4e64-9857-26a6c5482405", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.179.27.98']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--767fb29b-931e-4dfe-8bda-8f4bd27d154b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.3.170']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be03840-2f5f-4999-bcdc-ff36b063b962", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.117.225.169']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c668bd71-8b1e-4b42-ab33-53b0cc1e87ee", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.125.115.161']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c61999-8bf7-479f-bca9-234f811288e3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.158.22.150']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b32d6f5-7e4b-4755-8c36-3e0b92c56f4b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.163.212.25']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, php-backup-grab. CVEs: CVE-2000-0868, CVE-2002-1149, CVE-2019-5418, CVE-2026-9198. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.24']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-0868", "external_id": "CVE-2000-0868"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "external_id": "CVE-2026-9198"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3af34d1c-ee99-46af-80b5-d37af7ecac80", "relationship_type": "indicates", "source_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8a656e77-5945-452e-b9ae-ecc17f94bc90", "relationship_type": "indicates", "source_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--55df544f-efb8-4c39-afbc-aa99f852b3fb", "relationship_type": "indicates", "source_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "target_ref": "vulnerability--b1fa8223-720f-4609-966c-aa8ad20d832c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e170778-128d-410e-964f-3f4f0ffbd212", "relationship_type": "indicates", "source_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1db0c8ce-3f60-4e20-8cd2-859ca13f0b9d", "relationship_type": "indicates", "source_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--95f4290d-a3b5-440b-8053-e9351a194ca6", "relationship_type": "indicates", "source_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "target_ref": "vulnerability--7ab1b8e2-0e68-4add-8d99-3c5f05b19be9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaed1383-1106-4670-9d62-3bd13ca4f757", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.31']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "name": "Malicious Host", "description": "Web exploits: apache-solr-admin, aws-credentials, f5-bigip-icontrol, f5-bigip-shared-auth, kubernetes-secrets, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2016-0061, CVE-2019-0193, CVE-2019-5418, CVE-2020-5902, CVE-2022-1388, CVE-2022-22274, CVE-2023-0656, CVE-2023-46747, CVE-2026-9198. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.49']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0061", "external_id": "CVE-2016-0061"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5902", "external_id": "CVE-2020-5902"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1388", "external_id": "CVE-2022-1388"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46747", "external_id": "CVE-2023-46747"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "external_id": "CVE-2026-9198"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--59b2d164-ffd6-48ab-8735-daaab5127f4e", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "attack-pattern--6ae2a860-f20b-4055-823d-4e7a9028965d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1d3c03e-b317-4233-b4c6-a9157ca2ee70", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--de50a600-4e60-4d5d-a21e-b0f2a1479867", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "attack-pattern--982b846d-1095-4d39-bea2-cf3e5eb7a9d9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4d001b8f-085a-4498-a247-1c6c42ba7523", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--df260a87-02fa-4998-a7fc-77bf4925860a", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a198e5a5-8b70-4f94-a37f-c1c3a8837ac9", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--b374f560-b416-4f5f-ac00-07123cb91230", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c4e2d4d-0765-423e-ab02-0297cca42eba", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--783eaf01-1f68-486c-9e37-4a241bae87ec", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dbb61a71-b12e-4221-b18a-f6bdd84e4e48", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6fdf45b2-9c01-4f14-a416-3400892b97c3", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--aa103677-613b-4076-b298-c5869231420c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e91076f0-39a2-4c67-84a9-f55d21fdd216", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--21e79671-997f-4230-8d54-031cd20c2a30", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b8bded0-6ba3-4e21-afd6-ca63a0bd73c9", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0047dd7d-1bfa-4693-9991-a584165ee76d", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1474eb8b-bac3-4796-a5b7-89afef72ea54", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a1919932-ebf7-48b6-b830-1fa55917e596", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--0ad984bb-fc79-41fc-9866-07b36e5471b6", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a1694fe0-4bde-4130-90b9-1a1fe2b4214e", "relationship_type": "indicates", "source_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "target_ref": "vulnerability--7ab1b8e2-0e68-4add-8d99-3c5f05b19be9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb54fea6-fe6b-4e29-8c62-26cca4f3344f", "name": "Malicious Host", "description": "Web exploits: mitre-t1190. CVEs: CVE-2026-9198. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.56']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "external_id": "CVE-2026-9198"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--727ffac4-47c5-424f-b610-650a3fdf13d4", "relationship_type": "indicates", "source_ref": "indicator--eb54fea6-fe6b-4e29-8c62-26cca4f3344f", "target_ref": "vulnerability--7ab1b8e2-0e68-4add-8d99-3c5f05b19be9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f54d1687-4f37-4c5d-b430-5f72cfca47af", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.19.40.62']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11461990-b446-4c97-be70-12a0a7045f69", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5182423d-544a-4476-8fe5-5c8635388ed7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada6d8c3-f645-4595-a910-fe1a3b695e01", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb7ed49-55bf-433e-894d-f54bcc6b52db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--536c5b7a-5c42-49cc-9737-0ad6eb444141", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3c53764-af93-4a78-a9ff-5263f174934c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31b9036-d42d-433b-a650-989a1c0f21da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c46837-4b0a-4160-92a1-1c5d551792cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c57df7b-3e64-4f1a-bef0-7aedc3c2c3d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d946aaf-00e0-42e7-9023-f328ef8c65eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759983a2-2dcf-47f6-9aeb-6ac4b5157653", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c746ebf-41ea-46fe-a2fd-24698809a561", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cad04f2-81ea-4b0d-a4d4-ec5b0df448a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ab816e-c251-4e2f-84d9-11c86de20608", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6fadee3-78c1-4766-b840-0461ab8292bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb55e32e-a252-463f-b7b4-99b5eded6480", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec47a20c-51e5-41e3-ae49-7db8c0b83450", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc34c57e-27d1-4a5b-a64f-936b509f5e83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96811212-8754-4bb1-818e-6bc57289a061", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06ca7c2d-9e22-40e4-8570-f04b7debf67d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.222.145.42']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1746985-b1da-498d-8385-d0d9ca90070f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.233.3.95']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3efad483-e421-433c-85ed-fa19493f4fe8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.240.215.110']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c92dacc-89bc-4ef0-bf6b-85c73c17a051", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.244.182.178']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84275bf1-8920-4a63-bb2c-2916b943628e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.37.67.38']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8ae891d-00ea-4c92-b8ef-e1b6c357082d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.0.187.41']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b8789e0-f716-4652-877f-80616ff0ba37", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.10.86.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d21e5cf0-76ef-4e1b-83d0-149b5acf1d35", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.13.59.30']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f0e9496-b29b-49f7-bf5b-b63e42167748", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.182.50.81']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f34d2f4-c228-49b3-bf58-64fc16822e38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.205.21.222']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d35fd5-d22d-4b96-96c6-88c6e60471a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.237.230.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d2fe46d-4fbc-45dd-838d-5765c9f1f0e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.49.14.221']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9b30d3-f889-41a6-a0f6-29083c9d26f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.93.216.140']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c287f22d-d52b-49ad-99a4-073ac4d799bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.190.254.219']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540389cf-963b-4e01-ab02-b220e5b06550", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.193.252.250']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b31b46-62f8-4fdc-9d22-a1350c754d29", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.204.71.179']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca9b0290-6919-438b-a432-8241567af8e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.212.17.164']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a756ffe9-a153-4b48-bc0a-ceb600d1458b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.62.234.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f2f4d66-568d-4dec-8282-527d396ac824", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.75.152.79']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd2ceb2b-0822-481a-8d94-9bc4bb34d967", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.108.211.243']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035af755-ae79-42a3-a00f-350d2234805f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.192.215.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f5f3b47-d1bf-4fa1-bbe3-da96e7a95bdd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.62.163.6']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe0b3c36-ff74-46fd-bdca-69bb0c488762", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.64.212.8']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a7b4bac-e756-470f-99da-8f097d14280e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.190.247.136']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a7e5cd-f415-4b89-85f4-14f1ac26e7a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.38.34.197']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6fbd801-d10e-424b-b7f7-6e3da5c73b3f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.153.1.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c64ee05-83e3-4bc5-88f5-ae51f0815158", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.64.90.158']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--249adfcd-6f26-4494-8f6e-208cd68631a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.81.199.249']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccf10506-aa2b-4bc3-a920-6010c38bcd62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.96.150.55']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c4d174-ec52-452c-b1ae-ec96f44eb9b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.121.147.73']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c55006d-6429-489f-845e-f12310f9a9b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.175.111.230']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--527218b6-c00f-4486-aae1-6f40820cb1be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.115']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--258dcf78-24ff-41c5-be59-3d77e01795b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48a92d33-fd6d-4cc3-9a7d-a3aae0f483e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.9.228.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe4c6afd-dfb6-4329-9a05-9ff27d269626", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.107.177.198']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa3232b6-fa64-4623-be8c-fc2bf3d7ea0e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.121']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276ae3f1-21a4-4344-bb99-028b24530339", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.218']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--683e0a31-feaa-47ea-ad29-6e48426d05f6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.248.32.236']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6010e60a-e3ae-4146-aa99-71590e8784a0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.250.182.104']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--438f8c47-fb99-4a5e-9153-be5ef1113b2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--831f7867-a3e3-458d-a2a1-982010580ad7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1114071a-0ff4-4cc8-a305-3da8ff269a44", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.47.62.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--201418ae-f162-4757-ab0b-99d359bd88bb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cba3c83-abef-4725-a3bf-cdb5b9eb13e2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4feec7f7-11bc-4348-ad84-03b91fbe170f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--914e5032-0ef8-41cc-941c-893e32d1dd4d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.15']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc91dc04-7a5c-431c-9e39-25f3df9c71a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--597076fd-7b7d-479d-9592-fd8417bd968e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e817c11d-dc28-46e0-8b72-9c16229548bf", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.5']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c793265-2942-4c11-b8d5-866fc178083e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.6']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7580cb60-38c2-41af-84f8-a8d5c705d847", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb6673a-156e-4ce3-8787-2dbf31ad9846", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.14.223.72']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223758be-93c7-4ff6-b033-7ded1d59d9d3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.206.110.101']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84147bfd-dadf-4ea3-ba89-4d5d2d3ebffc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.21.21.231']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbf8a615-159d-44eb-98c6-21e5d74aab06", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.32.168.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--351de933-d96f-4e18-92fa-53dbff6fa94f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.68.17.149']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af8f51b6-f224-40f5-ba8a-bbdffe0407bc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.166.164.221']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04373af8-7faf-46c5-a826-0f0548d2d500", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.227']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a93778d-add2-41d1-913f-27d3bb9e37e1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b600d874-5cc6-4b48-9d99-b9b132742f5e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.228.227.41']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1668d74a-46c2-4352-9f8b-f2cbd96828ae", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.25.96.245']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7f3744-f312-4099-a7f6-8769e1bf181a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.3.220.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d650657-a5d3-4378-8645-e4709f118de9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.74.225.123']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04685df1-0df0-4d94-a7ab-4cc2337115eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.119.41.251']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb31349-5867-4fd7-85cb-734ce1a0c7df", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.166.67.220']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee78c720-c869-4128-a611-bebcc6b563e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.101']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5afd7da6-c410-446a-8eae-c1d0e4890cb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fefa0ca-c8d7-485e-a5c3-3b1376acffd4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.113']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7aa8251-5bb3-437d-8fbf-e03e89147937", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.116']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6310f636-4027-485f-931b-3be663361184", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d145a606-6cb8-40b9-8ed7-14009eceb0f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.154']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4daf6a7f-c95d-409b-8906-bedc7bba1c31", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.158']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42df4fb6-14a3-4a07-8a8e-d7140904ea44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--159e8456-2000-40f2-936b-75228b347ffd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.186']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7be099f-ae42-49a1-87e6-93cbbbab3911", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.211']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--872651e4-2986-416a-ad9d-a63fb6f2c173", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.237']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e94ed29f-6eeb-4fe3-9d0e-f9412e135676", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.25']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1742640a-7205-44eb-a08f-dacb599a8948", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.26']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89940136-e85a-4d1a-a1da-cf969dfa0eb1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.31']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bafc678-eb69-48d0-b98f-ffde3226ff4b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.33']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cda2e48-deff-4987-b2a4-51aaa14a49c5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.44']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3caa1dae-1a7a-4953-8798-63e6568f860e", "name": "Malicious Host", "description": "Observed: REDIS, WEB activity. Sensors: cfglobal, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.52']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrtokyo", "protocol:redis", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f43ad1-da6e-4fe6-9097-ea5e32989603", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.56']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71d965bf-a0b5-4d2c-92f7-161a49cc3100", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18d71dd9-0fd1-43f0-8ab3-4eef4bde1822", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.75']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35b70df8-0f73-423a-99d3-8b6683964f01", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.88']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de2680d6-81f4-4b8f-a231-cc03bf4605ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.98']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779f0ee6-5813-431e-bc9a-26bdb1842ed1", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.244.200.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa93d960-ac4a-409a-9c14-7d0e062327cc", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.27.77.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b8ad393-9fb9-473a-8529-fdb2c9d37bed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.19.225.232']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c43ad79-3bf8-400e-982a-f902b2b2ee61", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.137.110.82']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27c14d0-62a9-4a27-a4a9-a4fc593da091", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.188.206.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64363c0f-d1d5-4cde-b9da-03c5dfd09abb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.44.87.191']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788afec9-f171-47e7-9457-925f6ea78254", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8df5c7bd-4638-44c6-8c0e-c4c6e1f3a5ca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f38faff-d990-4126-83e7-abc8eb6579fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25881b1b-4158-40a1-80b8-07a880a84afc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.53']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238fa334-743b-4ce3-a6c1-2634d53b322d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.74']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f4f4b03-0e4c-445c-a2bc-a44169b81776", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.201.169']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9fddd136-17f5-43ba-b773-596f108bb513", "relationship_type": "indicates", "source_ref": "indicator--5f4f4b03-0e4c-445c-a2bc-a44169b81776", "target_ref": "attack-pattern--6ae2a860-f20b-4055-823d-4e7a9028965d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d2d2590d-4b60-4465-97ca-40f0be0d59ac", "relationship_type": "indicates", "source_ref": "indicator--5f4f4b03-0e4c-445c-a2bc-a44169b81776", "target_ref": "vulnerability--cceee095-1214-46a6-b5b5-d2e205f87c06", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8a74dba0-cf7d-44f6-9ced-79a38c86a220", "relationship_type": "indicates", "source_ref": "indicator--5f4f4b03-0e4c-445c-a2bc-a44169b81776", "target_ref": "vulnerability--36cfbfbb-2e64-4786-9fc8-eddaccba8c36", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51757df8-96f4-4ae7-9731-e4b682459491", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.94.94']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e2d100f-255d-406d-8bfe-6795648d7532", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.13.40']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa89ba8-651d-4f1c-ba42-d0f59420627b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.194.30.107']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a736195-aee1-4306-992c-25e140f14d32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.197.26.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9535587-1ce6-4fff-aa38-a64446a48603", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.205.114.149']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5110064b-1bab-4a85-a0f7-7ca18bb8dc69", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.210.186.186']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c707ad15-7e76-4e0e-9169-fd6bcdf85d7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.213.164.196']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd6550e-6fca-4171-a57d-b241cdd31e0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.219.11.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13955a6-0499-42e5-bbd3-7a86578c46bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.219.14.152']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c8a730d-61af-4f07-ab8e-9bf609cafe47", "name": "Malicious Host", "description": "Observed: WEB activity. CVEs: CVE-2002-1149. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.219.185.206']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b52e4499-f7a7-4551-84a6-68b5cfa8bf07", "relationship_type": "indicates", "source_ref": "indicator--8c8a730d-61af-4f07-ab8e-9bf609cafe47", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d148ab19-7911-4446-9cdf-225675f37b53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.28.180.172']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00e5af9c-ce42-4255-a7ff-78c671fcde3b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.54.27']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ce92044-c1ad-4795-9255-2cc0a5bd8539", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.44.232']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3429288e-a554-4d95-94d8-ad302afb68cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.92.77.159']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5107137e-0e41-436f-af60-43e1263cba52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.189.64.96']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1172b593-2048-4382-9b54-707831a8a75c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.49.31.32']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3402cb3e-5dd5-4459-8f64-6e431b8a395f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.69.81.58']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae95d57-6ed3-40b8-be91-5a0746143c1d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.221.114.26']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff5e6a7e-e9dc-496a-b15d-85f219047829", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.180.206.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b40a5bd-ff9d-48cb-ad07-d0ad5550331c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.185.145.206']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152e5580-b9c1-46b2-bae8-771fc234e193", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.47.56.97']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16fb481d-2d22-4f69-aa5f-da2667831d3c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.167.15.64']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d36f9ec-5ac7-4ef5-95e5-5af81421e70c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.206.104.88']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed2baf29-01c0-4430-b8f3-1c68b531fda8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.197.179.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5945e718-7ca6-4318-8d7d-a5039af3934f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.93.239.56']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20c62f5f-4a2d-4b80-9d9c-9a06908cfb2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.150']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc2d8a6-376b-4595-acf5-561d06859ee1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1de80741-289b-4f53-8191-c7fdb8bf29c0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.168']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f64481c-c0af-4f75-bcff-f1c86d45861e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.177']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812adbe3-a6f5-4d05-a30a-1a01b599b931", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d10b1c06-9437-47e1-b002-6602347508b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.226']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fd8d5c-640b-4f48-b1f6-64a1716234b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.37']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a57948-7f57-4fa1-90b3-2c0e656cba2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.5']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ae44610-44b0-4667-9ae5-2733a8072e27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6047014-9978-4b92-a4a7-506d87691ef9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.93']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d812548-f3a2-4518-acf2-1ec7ba6a9542", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.170.227']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7c6cbdf-eabc-40b4-aa5e-ff705133a6a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.180.11.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34151ebb-77c1-44b9-afdb-0253838d88bf", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.20']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43fb9aa7-0051-4224-a252-171300480fe5", "name": "Malicious Host", "description": "Observed: FTP, TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.21']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1faad29c-4a96-43e4-a6b9-aa41bddca3f8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.171.183.193']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d7d0959-07fa-46df-8ad1-c54b9d37a43f", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.70.156']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd115209-a6e2-43d1-81f2-6b32a2ea068d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.100.242.23']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f291f7fe-10f2-41c7-af16-15b39a42dd73", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.113.5.133']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ca5588-131c-4811-b89c-f1524a3d5843", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.17.252.214']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--615c9c31-9365-4fa7-b952-e7ed996f9558", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.178.237.6']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2635a4a7-b7bf-40ec-979f-7a527e5dc61f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.242.91.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f7fb108-5ebc-444e-a150-907664da6724", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.202.144.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c573e781-e7cf-4944-b52a-28e6be347fa0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.225.247.177']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b11c3db-96dc-404f-99bb-48d55ce232c5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.253.37.225']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4adc8126-4f19-498b-a775-1adc6ec0b6c3", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.112.108.122']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--357f880a-b25b-477e-a417-7d280d6fc43e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.132.221.99']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b669d077-e7fd-4943-999b-e0c11ffe888f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.147.59.241']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9e7e028-3732-42a3-abbb-17e65c42a646", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.177.179.91']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3f21f27-7fe9-4ea9-b74d-d3b7831007c6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.23.74.2']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abe208ee-f620-4251-8ba5-a8438b6e04d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.34.229.33']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f91ed30-0f0e-453b-88ac-2bd91887b2c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.47.155.244']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f452fba9-89d1-4307-b0ec-a59f2395539a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.232.157.210']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c97ff426-7cde-4cbe-8b97-4ee3dbf1f9a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.221']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bb81007-83f5-48a0-b43e-52848c996f22", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.152']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d2bdd5-1b70-4a21-8239-e5ee4d7562bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.153']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd0bbd51-1655-4d3b-9a4f-f93cc3ad562e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.75.132.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e36cf727-abc6-45cb-9207-973db4ba7601", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.81.200.21']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6dae9f5-ac59-4875-bdfc-29b4d773645e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.226.203.95']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--897384c1-88ef-4469-abc6-1e9b7c9354f1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.27.180.254']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac6a1361-9147-4d8b-bcb2-ca6e55dc4f4b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.81.168.244']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16c801aa-dba4-46f4-8215-0da6d1bb4e38", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.92.18.59']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af6ce598-bd24-4b4f-b282-b8d32fb4af4a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.148.42.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d95150-fe5f-4f47-a8ec-dba79f0d7ec8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.158.239.173']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa95b6e3-6aa9-49e6-b96d-b8446733630a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.172.22.81']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b14061-864a-4740-a51c-43f8875a293a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.232.83.100']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58fcc7cf-f372-45c8-8896-36a1d1715039", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.35.202.19']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd980e59-a7f3-40d5-a759-dc1d777119be", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.133.110.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f95e5fab-107f-4fa8-bb17-53cfef4b2d69", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.133.162.106']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e936bf66-20b7-4559-aa84-20a7daa45cea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.133.4.152']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--253f31df-82ec-4b3b-915f-7d56c9a92a63", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.135.218.179']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--677378ec-6166-4a46-beee-a9a5a6d747f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.114']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b80217f5-27ca-4a3d-9ae6-fba37df584db", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.78.58.227']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ada5e0-96f6-4564-b0e8-1ff47ec07d1c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.80.180.232']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce48714-c89d-44c3-8d87-8ba4c4721dd4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.86.31.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ea09ac6-1422-4c88-8e3f-99721e16dc85", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.127.175.105']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e206a16-1722-454d-90a1-d12fd05eee2d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.149.11.87']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--571ab340-fcf0-445f-8901-2e451dd76866", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.15.7.17']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03776a10-0995-4459-840b-86d1d9c2d3b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.165.174.87']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2c2aa12-fcc8-4566-b827-cde02b6b68af", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.127.12.19']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e09b94e-96a9-49ab-9e5d-3cc4bef16369", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.252.11.106']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd708cf0-1ead-4956-a215-82bf4d413e92", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.97.112.179']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0262051c-5f2e-4566-bbb6-7ec8bb679972", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.18.35.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca5e9899-96b0-41f4-b5a0-70f46b9e096d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.19.69.201']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a69294be-0f9d-42b9-802d-0a6f876ed299", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.197.179.99']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--190d2729-e161-4307-b9dc-79f9d31a25e4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.206.61.34']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166631d3-bc4c-483c-9a82-4547001a9a4c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.100.83.23']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f740bec-a3b9-4b39-871c-aaf641348a8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.102.121.171']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49d8959-ef50-4e56-8f94-05a60cdd9c3f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.134.91.129']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9895cff7-b0e9-4dda-aa7c-88692a805440", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.224.82.133']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "name": "Malicious Host", "description": "Web exploits: aws-credentials, f5-bigip-icontrol, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-19781, CVE-2019-5418, CVE-2022-1388, CVE-2022-22965, CVE-2026-9198. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '2602:fa59:10:c38::1']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19781", "external_id": "CVE-2019-19781"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1388", "external_id": "CVE-2022-1388"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965", "external_id": "CVE-2022-22965"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9198", "external_id": "CVE-2026-9198"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd345b5d-fbb1-4a38-aa67-73cef424b615", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5a1295dc-5196-4555-ba9d-7db662dbe6e8", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "attack-pattern--6ae2a860-f20b-4055-823d-4e7a9028965d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--06f5e973-9a3a-4335-a972-d2eec21001c3", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4eb985c0-6f0c-4c04-be31-935d7a33c4bc", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ad550d7-790f-4ecb-ad0e-691ba08e7547", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--43644ded-6511-4e24-9784-f2a53bc94180", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--006ba467-b21a-447c-b4e3-3db1e436ba28", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f24b0864-afd8-40b7-a080-c6c7aa7b0c7a", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--21e79671-997f-4230-8d54-031cd20c2a30", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cad65136-1089-43ba-8ad5-b509c19cf028", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67179689-d979-4887-bdf1-a199a12b6d72", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--92c2dcbb-4629-4c79-89ae-52aa5624e7f0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5786a106-d8dc-4518-8a73-d4e00d6101ca", "relationship_type": "indicates", "source_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "target_ref": "vulnerability--7ab1b8e2-0e68-4add-8d99-3c5f05b19be9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ed03e7-5916-47b6-bd68-c68a479c1f07", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.200.53.114']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada3ec24-1327-424b-a798-85db53014354", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.44.125.38']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79ae51fb-76ee-487f-94ab-683c75d341ba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.54.59.180']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8535bf61-f99b-4d8d-b360-c9318506aa0e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.11.114.250']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--970e5424-ccf4-4703-a4b3-82d23cfc049f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.169.116.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--342b5b36-40a7-4619-9cc7-75275daa5629", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.173.86.249']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a36b34-86ac-4816-9888-695feb868231", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.18.100.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14ecb896-57ef-4e39-be1f-29ceed2d5a69", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.18.82.212']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394da047-edd9-4f83-a7f1-2698f5621878", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.43.255.140']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c4231f2-df58-4752-b3e0-9b24a2ecbbba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.47.102.255']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db1ffc2-c3d4-4a1c-8aca-f5b5302142e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.59.160.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8ccd31-cef0-42f7-93f9-6d9455fa552d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.121.213.64']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a2f6fda-871e-4c2e-ac06-7d10a7045102", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.132.132']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47a74931-419e-4de7-a4de-b3a924579cff", "relationship_type": "indicates", "source_ref": "indicator--6a2f6fda-871e-4c2e-ac06-7d10a7045102", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4a8e6a47-6d82-4491-8c8a-9780e14a8e17", "relationship_type": "indicates", "source_ref": "indicator--6a2f6fda-871e-4c2e-ac06-7d10a7045102", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--887d7a60-a137-4056-bf35-3ba790cbf4cd", "relationship_type": "indicates", "source_ref": "indicator--6a2f6fda-871e-4c2e-ac06-7d10a7045102", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3c1182-70fd-461b-88a2-26f83bc89015", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.121.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--98ecc98e-cefd-47e4-a830-4a38d54d5edf", "relationship_type": "indicates", "source_ref": "indicator--8c3c1182-70fd-461b-88a2-26f83bc89015", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8c6d4948-7575-49d9-bb6c-05d4035f5fe7", "relationship_type": "indicates", "source_ref": "indicator--8c3c1182-70fd-461b-88a2-26f83bc89015", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8167b699-bb6b-4f98-8448-be8a0bb66b4a", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.166.79']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a5032a1-68db-4cab-ba1f-33b265fe2949", "relationship_type": "indicates", "source_ref": "indicator--8167b699-bb6b-4f98-8448-be8a0bb66b4a", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d0549cfe-de7c-4fdc-b834-aa0dc14b26fd", "relationship_type": "indicates", "source_ref": "indicator--8167b699-bb6b-4f98-8448-be8a0bb66b4a", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ae313c-1347-423d-a33c-0fc3b52d1b8e", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.56.233']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84ef92d5-62d7-433b-afa9-7e7b174d726d", "relationship_type": "indicates", "source_ref": "indicator--83ae313c-1347-423d-a33c-0fc3b52d1b8e", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ee4d725e-a7eb-4000-a68c-cfd003375105", "relationship_type": "indicates", "source_ref": "indicator--83ae313c-1347-423d-a33c-0fc3b52d1b8e", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a54de28-f086-427d-bbf8-4f09566ad59d", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.168.103.222']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3fe1617e-ba36-4a97-844f-78ae04b8440f", "relationship_type": "indicates", "source_ref": "indicator--0a54de28-f086-427d-bbf8-4f09566ad59d", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--35805a8b-c58e-4721-92eb-92ef10c3c455", "relationship_type": "indicates", "source_ref": "indicator--0a54de28-f086-427d-bbf8-4f09566ad59d", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3daacf16-82df-4207-9f7e-9e265111a496", "relationship_type": "indicates", "source_ref": "indicator--0a54de28-f086-427d-bbf8-4f09566ad59d", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df14ec23-5cd9-4075-9c61-3fa5fb031da5", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.179.164.52']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--120542fb-61a8-43fd-937d-b0142d8d6801", "relationship_type": "indicates", "source_ref": "indicator--df14ec23-5cd9-4075-9c61-3fa5fb031da5", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--18336566-2371-456d-bb26-818cf9509678", "relationship_type": "indicates", "source_ref": "indicator--df14ec23-5cd9-4075-9c61-3fa5fb031da5", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--724fb977-76e2-48ae-8d38-1c66910da790", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.19.215.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e8c62f5-d869-409a-9fb6-f0b46ee6ff91", "relationship_type": "indicates", "source_ref": "indicator--724fb977-76e2-48ae-8d38-1c66910da790", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f88d2657-e41f-4c0a-9102-b28cbc39dd2f", "relationship_type": "indicates", "source_ref": "indicator--724fb977-76e2-48ae-8d38-1c66910da790", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.23.147.147']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c84826e-e17c-4cdd-8170-16865ef2ebc1", "relationship_type": "indicates", "source_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8afb2ae4-7e35-4c53-906a-02fee360d9e3", "relationship_type": "indicates", "source_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6cb439ae-da53-4085-8f97-f34f750d5b0d", "relationship_type": "indicates", "source_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e90ac865-995c-4768-b006-9ab0683655b3", "relationship_type": "indicates", "source_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--395acae4-df64-4ae8-94b8-79ec4ba0e9c5", "relationship_type": "indicates", "source_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78eb99d3-479b-420c-a437-a94fd9541877", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.30.87.32']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea39fd80-d94c-4db4-a66e-46e3a8d0c183", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.160.116']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.50.113.115']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--26b11764-d0b4-4ec4-b799-ffc36b626df6", "relationship_type": "indicates", "source_ref": "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c42dda4-e022-40d6-bf88-e693ab0f2c17", "relationship_type": "indicates", "source_ref": "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d5e570e3-cd1c-42fc-a8f9-a95775637e21", "relationship_type": "indicates", "source_ref": "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34548ecb-ea79-4186-bd08-c48e58e73ce4", "relationship_type": "indicates", "source_ref": "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd9a0195-7300-4bfa-9cf3-d1c3f5dc5cb2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.229.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.6.166.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e13c113-1495-4637-b43b-26f29adf7bc8", "relationship_type": "indicates", "source_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6647d5ee-1c4a-4f3a-83e1-0169639a39f5", "relationship_type": "indicates", "source_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a0c6c376-6de7-4e91-a0ba-228e64dcad3d", "relationship_type": "indicates", "source_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--30cd7f73-78c6-412f-a712-3a7b1c8f2219", "relationship_type": "indicates", "source_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--10ead337-a7cf-4203-baa8-72436b4451f5", "relationship_type": "indicates", "source_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd0e3ff3-68f5-44d9-822c-a1ec44b61e72", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.6.78.29']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64991e9f-a450-4ed8-98d8-1d139a0a470a", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.116.145']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71157efb-8607-4e19-bd4e-09358cbd5cc0", "relationship_type": "indicates", "source_ref": "indicator--64991e9f-a450-4ed8-98d8-1d139a0a470a", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e1bb6fb-c949-44ec-8ab0-f3b0a2130e5d", "relationship_type": "indicates", "source_ref": "indicator--64991e9f-a450-4ed8-98d8-1d139a0a470a", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246cb5d3-9114-4c11-b7a5-0a24df039af1", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.60.37']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a906e25-3667-401d-9549-547e782b2e43", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.68.223.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759a1240-9a9f-48ee-8c4d-309e945ea6a3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.17.20']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4519d69-6f74-4ffa-8b74-23ef9a41e21a", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.187.255']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe7de4b-3914-471a-8051-dbc558203f6a", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.226.40']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29cda941-e907-4562-92d7-48b70fb674f1", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.64.142']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b4330f2c-d328-4406-b8f0-46496c68bb00", "relationship_type": "indicates", "source_ref": "indicator--29cda941-e907-4562-92d7-48b70fb674f1", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8cffeaff-ecbc-4da2-a904-b3d1628c3da5", "relationship_type": "indicates", "source_ref": "indicator--29cda941-e907-4562-92d7-48b70fb674f1", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3501d0a8-e652-4957-8c89-36b68c3d9136", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.12.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e9427a43-5c11-490e-b126-053fb430f162", "relationship_type": "indicates", "source_ref": "indicator--3501d0a8-e652-4957-8c89-36b68c3d9136", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5630c74f-adbc-4dc1-9718-34d9d655d855", "relationship_type": "indicates", "source_ref": "indicator--3501d0a8-e652-4957-8c89-36b68c3d9136", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bd3e8ce-d087-486d-ae56-ae387f593931", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.203.208']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.23.116']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--52b63fa1-524d-493a-ba41-f2ba67cd5c81", "relationship_type": "indicates", "source_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d81868d-b8fe-47d1-9c6d-2ef3100bba64", "relationship_type": "indicates", "source_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--68529636-2be3-4357-8a54-06867c8d7955", "relationship_type": "indicates", "source_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa858083-5633-4c4f-bc4b-2a371b96a99c", "relationship_type": "indicates", "source_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--304c0482-e26f-4428-b6ef-2cb2ef342334", "relationship_type": "indicates", "source_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.81.64.235']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--de640421-b503-4bbe-a3df-7ece18ae80e7", "relationship_type": "indicates", "source_ref": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4e4b4e7c-ff34-479c-8a56-044f913f701e", "relationship_type": "indicates", "source_ref": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--90f781ae-e143-4816-9fd6-d1c8e52f99fb", "relationship_type": "indicates", "source_ref": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c01d9fe-a95f-459c-8514-a1791c3ca846", "relationship_type": "indicates", "source_ref": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef6ae754-21c1-4601-9400-fd4f6628a1a8", "relationship_type": "indicates", "source_ref": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.84.231.205']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eccfdcc5-0f82-444c-b42c-f900b7def6f1", "relationship_type": "indicates", "source_ref": "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4507b39d-5811-4346-aa62-81c98acbcb61", "relationship_type": "indicates", "source_ref": "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d5a1a191-c533-4b14-8412-c0acc7c4b0d6", "relationship_type": "indicates", "source_ref": "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1fd8523d-3514-461d-b0aa-40ea75ba6b6a", "relationship_type": "indicates", "source_ref": "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98662a19-dd99-4d15-bb34-969ecd8a5d53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.84.50.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "name": "Malicious Host", "description": "Web exploits: aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.87.176.234']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--07a1bf74-16cc-4711-ab20-a58315c71e7a", "relationship_type": "indicates", "source_ref": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb8d1d3e-ee0e-455f-a00b-7940c1872df9", "relationship_type": "indicates", "source_ref": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d2395456-77a8-4c85-8adf-af2b302d3fb9", "relationship_type": "indicates", "source_ref": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3787bee-572a-4013-b713-a05bc7b5fd45", "relationship_type": "indicates", "source_ref": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b983741c-f140-4d63-993e-e30d5f61a35a", "relationship_type": "indicates", "source_ref": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26786ed1-8a09-4dd5-a2b7-3cff98280e30", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.90.218.191']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a535ef-62d2-4353-ae32-a28c1da1594f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.93.255.29']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.185.136.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef0f2161-51c3-40aa-8750-dd1ca925adb6", "relationship_type": "indicates", "source_ref": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--87a6694e-d1e0-4844-b26b-531f1ef08b82", "relationship_type": "indicates", "source_ref": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2afc2a38-1aff-4994-ac56-a26073848000", "relationship_type": "indicates", "source_ref": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7f7deed8-a63a-4bd2-a035-57dc784748b9", "relationship_type": "indicates", "source_ref": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--abb298b4-56fe-4a24-845f-f25f487f159c", "relationship_type": "indicates", "source_ref": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cd3cf7c-569b-41bd-90fd-ef576b05077d", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.202.18']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54034ac-6119-4891-ae7e-b466265e56bd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.153.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a7ab71-9826-4cdd-b1cc-a421db6b0079", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.215.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a96cb52c-a9ac-4023-92a7-69316b00874f", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.199.108.25']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--92bbe02c-a046-4020-8239-c3b0a9076f65", "relationship_type": "indicates", "source_ref": "indicator--a96cb52c-a9ac-4023-92a7-69316b00874f", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--beca9474-ee66-4d1a-97cb-668fd5a0716d", "relationship_type": "indicates", "source_ref": "indicator--a96cb52c-a9ac-4023-92a7-69316b00874f", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.199.64.152']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--11115ee4-ff77-471e-b7c3-d6f5e3a9cae3", "relationship_type": "indicates", "source_ref": "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1fb3b608-c4ec-4d21-a2ab-a444e2354ee8", "relationship_type": "indicates", "source_ref": "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--426d868a-5d80-49b8-9bc0-9936ca4d7dfd", "relationship_type": "indicates", "source_ref": "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e132a56b-46b2-4590-971b-e52925edd7b4", "relationship_type": "indicates", "source_ref": "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.213.238.178']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4fdf532a-cff5-41f3-8e71-db9bae9cf60a", "relationship_type": "indicates", "source_ref": "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--be7b6099-da0a-4c51-a390-922342b0f174", "relationship_type": "indicates", "source_ref": "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4fb8646e-b18f-48a0-b4be-12a2561fef8e", "relationship_type": "indicates", "source_ref": "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "target_ref": "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a19d263-c853-4e56-bc6d-e11d5c22f83d", "relationship_type": "indicates", "source_ref": "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "target_ref": "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.215.222.10']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--39c552a6-49b1-42ce-9131-d54d99715769", "relationship_type": "indicates", "source_ref": "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e79b2d8a-63b4-47f6-8b54-2c8bbc7667c3", "relationship_type": "indicates", "source_ref": "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e07e4606-50fa-4716-809d-4e37890b1947", "relationship_type": "indicates", "source_ref": "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "target_ref": "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--db5134c9-ea4c-424c-867d-1d00ee3d1a0d", "relationship_type": "indicates", "source_ref": "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "target_ref": "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09952396-fe23-47eb-a743-c257776cb68f", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.215.237.209']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4f212539-6bf1-455e-b869-0093eb1c8626", "relationship_type": "indicates", "source_ref": "indicator--09952396-fe23-47eb-a743-c257776cb68f", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e138d133-dfed-4291-9e9a-3b7f91d1ebc0", "relationship_type": "indicates", "source_ref": "indicator--09952396-fe23-47eb-a743-c257776cb68f", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--149af721-bf2a-4e72-b405-ce14f734013c", "relationship_type": "indicates", "source_ref": "indicator--09952396-fe23-47eb-a743-c257776cb68f", "target_ref": "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4b4662f1-1437-4c25-8786-00fde096d6ea", "relationship_type": "indicates", "source_ref": "indicator--09952396-fe23-47eb-a743-c257776cb68f", "target_ref": "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.106.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0f14877-caf3-410f-97c2-287cf37aa951", "relationship_type": "indicates", "source_ref": "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af23642b-f68e-4fe7-9754-424f71c88f59", "relationship_type": "indicates", "source_ref": "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c850e159-1479-4fb4-981b-7b154a1a95d9", "relationship_type": "indicates", "source_ref": "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "target_ref": "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2768d99a-9888-4ba7-aad8-e8c71e73edc4", "relationship_type": "indicates", "source_ref": "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "target_ref": "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7ea7d7c-fe40-42d4-bf34-2bd04f542244", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.36.201']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.221.69.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2bc472b7-b586-48a4-8133-39ecbd31fd47", "relationship_type": "indicates", "source_ref": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8797da3f-d65d-4bde-8b42-c8da88531516", "relationship_type": "indicates", "source_ref": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "target_ref": "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--344c33ea-4ec2-412e-bde6-f8a07c58b9f4", "relationship_type": "indicates", "source_ref": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--772da098-ce3e-4a35-8c28-e0e07931f34a", "relationship_type": "indicates", "source_ref": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d969bf57-ecef-4f1e-bf18-fc2476abb51e", "relationship_type": "indicates", "source_ref": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "target_ref": "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4ac20de-8612-4a8a-bc3a-a786dc127e1e", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.227.133.239']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7275412f-1d4f-4424-aebf-742964d33287", "relationship_type": "indicates", "source_ref": "indicator--a4ac20de-8612-4a8a-bc3a-a786dc127e1e", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7386a75d-4f84-4457-bff5-e452db3c8e03", "relationship_type": "indicates", "source_ref": "indicator--a4ac20de-8612-4a8a-bc3a-a786dc127e1e", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19a57c48-2d64-4e93-b7f1-60b11d7599e9", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.85.54']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b43332-f635-432b-ad1e-5432fe763ac7", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.58.49']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fad31377-4b34-410b-9a33-60337f3ed78c", "relationship_type": "indicates", "source_ref": "indicator--a8b43332-f635-432b-ad1e-5432fe763ac7", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2f2fd57c-17fa-43ec-9225-7f51249fab59", "relationship_type": "indicates", "source_ref": "indicator--a8b43332-f635-432b-ad1e-5432fe763ac7", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a7ca733-698c-4784-981d-9e64f9691e98", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.232.66.221']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6fb4ec9-c401-49d0-8018-4fa2d3a1ef7e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.35.165.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86bb8ead-8f81-49ba-949e-14cb424fb483", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.67.227.242']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0a6334-af76-420b-8ae9-a47146ea86eb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.81.49.33']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8fb2fe2-5d29-483b-a618-69dcbd588e73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.19.197.186']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df1eab7-a2cb-4df2-9eed-5d7c1d94ef53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.236.5.15']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8a57676-1cd4-46ff-891e-6d75c5cd38e4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.191.93.15']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88b9684f-7ce4-40b6-8cdf-8f421bb2180b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.160.26.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b0650a4-53c2-48f3-8cba-414cf5f4b6f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c5c399-1452-4c53-b886-64fee9172c7a", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.38.72.211']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04f1669a-cedb-4afe-b1a5-b44cb4a3d8e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.56.235.27']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b7b595-7038-4ea7-9c25-1c943b8d58d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.89.183.243']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15393fc3-731c-4a7c-b397-0d5e63620d86", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.113.109.236']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5486f46d-9d07-4b51-ab4f-41fb45742cf8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.225.150.162']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--562a81d6-7673-48e2-b122-5de7e29ba8fb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.54.64.188']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2afacc4f-25ec-43dc-86e3-0c2a59991611", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.58.230.212']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae6aff00-8ac6-4a66-a72d-592ae9ebdc1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.131.18']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aec10dd-e9d3-46f4-bc1b-2a4b661a121f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.253.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1640d3a1-35a0-4084-96f0-d3b351f09c82", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.60.94']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccfa4205-89cd-4224-975d-6f266fa452ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.117.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc2b832f-aed9-4bfb-a4c2-f6f729a7fba7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.211.148']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b21897d4-e300-4942-99ee-134c0ba2305c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.139.238.192']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a4771d0-519f-4650-bff4-09e37e82bd7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.135.208']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a6834f4-eae7-4900-bcb3-2638bdb6a1ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.37.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68e59fa-a02e-438a-9402-8f1a602a572a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.88.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--097791db-3cac-46ab-94b1-f8350f9d6b7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.154.127.188']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b25bf8e-7b64-4e84-9d66-b6f97ab2ef09", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.36.169']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeae4180-9160-47ca-ac82-7fe15dac0614", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.147.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5958a761-a22d-4da1-bd80-d4403cbd8a15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.150.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ca93bc4-5a41-45be-8fc2-1003b8922c34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.20.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67661070-7006-45df-bd84-260cb7e05f90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.38.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1d495b-c14a-4f97-a971-8be770a52a87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.88.190']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9bd0ecf-9171-425e-afe2-b9a2cc041c39", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.96.93']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d3243f6-c1d6-4ec0-a7ce-f36666e4a69b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.158.91.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5ea3724-09e4-4ef5-8b7f-9e66754076a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.4.2']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44621493-b8dc-462a-8f4e-89f1869ef30c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.140.147']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81a22ed6-2876-49cc-9b5f-53b2d7184427", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36391f3e-9610-4cf5-82a4-6442b9edf09c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.187.122']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c78ba85-ec48-446e-ad71-e2f44395ce54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.216']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23164220-cecd-40c1-ad75-a87838e98270", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.103.105']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ab1a440-de62-4933-8422-55ade0218147", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.23']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--48eeb566-7ece-46ef-8759-3a70add3a9f8", "relationship_type": "indicates", "source_ref": "indicator--2ab1a440-de62-4933-8422-55ade0218147", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff5512df-adfa-431e-b741-21aa1ad6e6e8", "relationship_type": "indicates", "source_ref": "indicator--2ab1a440-de62-4933-8422-55ade0218147", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4bbaf4d-d282-4831-9067-397fea4f8af5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e78453f6-874a-4b28-b7a3-a0f849cb5d64", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a85567-5d36-4c53-9c84-3324f97a3ff0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e772c69-0a4b-4a66-a881-7595d824f5f0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c0efa6e-4f70-420d-aa97-e0175199e4d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5bd722-76be-435d-96d1-5832476814e0", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.21']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ddf2e1d-6ad0-498c-a4c2-1aa2c398ab10", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.149.175.126']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a703065d-3ad4-4778-b274-2cf57a81cd2b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "name": "Malicious Host", "description": "Observed: WEB activity. Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: cfglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:cfglobal", "sensor:revproxy", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0b8883c4-47c3-4a2a-a9e5-304efc70dfdf", "relationship_type": "indicates", "source_ref": "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7bc6e327-0392-4cf2-9c54-812313554cb4", "relationship_type": "indicates", "source_ref": "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2993c3ef-45d3-431b-ae20-4f8e7118f501", "relationship_type": "indicates", "source_ref": "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b501c71d-54ff-4db3-b4e2-271128831635", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.161.54.135']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4834bd65-8b43-4237-9ba3-80666a987dca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.171.186.172']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19de7d7-776c-4fc2-a503-00bfe0124914", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.251']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--def3432f-5aba-4586-8c1b-91057ba0439d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.231']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db152f04-abed-4341-bb9c-4bc20e8b1a82", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.38.18.35']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f9bce2-3aab-4ee7-a373-ab2e0788f329", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.4.179.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8354f740-6ffc-4a10-9398-f16db67f7f30", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.107.240.236']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e099565-8b3e-4a60-8373-78e29f6e1ff6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.125.100.218']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f95b3855-d991-4601-be5a-04444bea8b71", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.129.30.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5373b6aa-72a8-4e8f-8f70-d51a90ac25d2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.139.192.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46088861-21c2-45ad-8ca1-f49f24027d99", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.185.209.168']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa5d92e9-5ac9-4524-82c7-4d38b6603af4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.32.32.237']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cfe2acf-5494-47f6-9eca-bdd7e4d1f4d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.109.67.33']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ee07d7-7756-498a-a850-0da6f41ab439", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.117.217']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e48272-61e8-4ec6-8177-f07186b283b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.117.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ec0254b-4462-4aa7-b6d7-c6950a6d7b96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.63.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30de864d-c4b3-4c51-847a-347bfbd5e7a9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.150.130.42']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe81ed4-13f5-4586-a745-791249059e9c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.155.105.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e8e721-ce07-41df-a720-5885a921f145", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.165.237']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ffef25-97cb-4f97-9f14-b3bd2306e4c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.93.236.2']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34ecf09b-4c11-4d0c-9d6d-5656c3d8c82c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.95.234.23']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d1192f9-24ca-4290-8e2e-d27022cb85a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.217.233.95']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4217202a-d9bf-46ce-9ab8-b1b05abc96e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.237.195']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d602c3e-2947-4a81-abb5-3c0e457df5ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.36.219.192']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40c37842-7f55-40bb-982c-df4462dcfc50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.252.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97fe5cf0-443e-48ca-9176-89d3073b8e3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.36.179']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87c2d3bc-0526-462c-9991-88e9c76c9e88", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.199.232.138']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d6cf95a-1805-444e-aace-958254a83cbb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.251.13.219']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d574693-84a6-4265-a2af-c88196cee675", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.253.59.68']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--905bb737-395a-4bfa-a192-d4247d807b25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.34.57.97']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ceef33-74e1-47a3-be65-867e19b09764", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '5.75.229.155']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7fb9c988-6092-4c54-8567-8d70e73c4672", "relationship_type": "indicates", "source_ref": "indicator--46ceef33-74e1-47a3-be65-867e19b09764", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f3cc568-630e-4242-885c-27cc3f6d1e55", "relationship_type": "indicates", "source_ref": "indicator--46ceef33-74e1-47a3-be65-867e19b09764", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c2d9676-9969-429e-9c91-eaf5c2123fda", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.171.16.122']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61d9d3cd-9eb0-43c8-9c21-37b7eb89cfd2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.6.54.173']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4425f531-ff6b-41b8-bea9-250a404fe7dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.14.93.241']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--717ff8f5-138b-4581-aca8-a53507ba9f8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.154.24.66']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac875c58-4cc6-4b3d-9457-5287fc820ac0", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.161.136.177']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02c2c5b2-5d2e-4c21-b79c-42bac60a1de0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.77.158.34']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4feda227-63f4-42cb-bc86-091a1e3f6d13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.8.102.111']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dfd8279-f030-4888-af0a-d0ede843b7b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.110.61']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b70eb3f4-67cb-4881-a880-bc49bf9955d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.110.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0186039b-4d8c-441d-aef0-e935d83d061a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.73']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089a93eb-7ebe-4120-b2de-cfd77b03b345", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.169.193']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265a4e64-e6d0-4d50-a42f-02eb1ad5fb1f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.83.242.117']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c489bfec-b949-48e9-b60f-58fc7aa1e71d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.166']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--950f571c-3f69-4ef5-90f7-64d0a75603e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.195']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4499cc03-4d9f-407c-b0f8-d8250162cd4c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.217']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c061c50-06b9-491c-8964-7ddc7f3035da", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.74.219.67']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52ca2bb8-3dbd-4a8f-9903-035c41529996", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.147.150.116']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eed15f7-74b1-47ac-bf62-d5c985cee7bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac4fe748-03b7-4997-8037-7a0922c4daa3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.122.244.194']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ee3209-ffe2-4980-9c58-09a36fb246e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.127.40.79']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dae80c12-9002-413f-9b3b-de9b7301f358", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.20.236.52']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99cdde50-6f21-4043-a6cf-025dc217dbb3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.225.216.186']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--783b7eb3-dc4c-4a86-bd41-2fb828ea2120", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.247.17.210']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e5fe3f-5263-455d-887c-43f03f7a36dd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.124.84.1']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1213282-4682-447e-ab28-69a9621dcde0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.14.218.35']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--062dcc06-09e8-4e9b-8ce3-2ed1369c8a6a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.17.240.248']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--830e8ec2-34fe-476b-a392-05057628e8d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.251.238.116']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e2bf181-cc6e-43f9-a711-c00b3bbf4322", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.50.56.112']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b743f314-bb3e-441c-8170-fe9883ef30c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.79.225.109']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d198e5-a02c-4158-8715-4cad43a3595c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.98.14.107']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c97a0c3b-56e1-4c09-8b8a-036cc153588e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.116.230.174']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e71bf9c-7970-42d6-b6b4-a75f25246427", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.158.162.139']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9758529d-bda6-47d8-9e93-5f3125265761", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.21.5.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b9ba97c-1259-453c-9903-053d8debde6c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.211.239.214']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732005cf-380f-4737-8c83-57410e010aa5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.246.102.107']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--487b2515-339d-4892-a46c-afe265b8f9dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.201']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f0469b-1d8b-403b-bf8e-7129a3305e57", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.242']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8d04443-e2a2-4499-b159-b4cf0c39c896", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5bb48df-aea2-4a17-be82-6e29f89a8f9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.91.50']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44766863-c330-4f33-b9a8-3281c1fed27b", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.66']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68a099f7-2ae7-4141-a44a-e088021e2479", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.90']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a82e5ba3-2ce1-4ef9-b001-2fb5b298a7cb", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.158']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--225d9218-d4c5-4f5c-9307-4c6d7f9a06c1", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.77']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0e54d4-4624-40fd-99d0-a7933c6dc8e8", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.78']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13fadb42-ff78-4fcc-9bc9-fbd759d25950", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.94']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ac46dec-1efc-4314-a6bd-e54ffd61b7a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.108.74.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06db1016-2ba7-4f4e-ad0c-094983febb7c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.181.112.168']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f96baa-dc2d-40a4-b929-ab84ed52689b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.254.92.190']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa1a702-301d-4a8f-ad00-f76ced7f7be9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1798cd3c-8b23-4c2c-8ad7-6749a4c3b067", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.168']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a18b4f6-465c-4ad2-85cc-93f65623a91c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.214.2.79']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ecff25-8425-45d3-9882-d86836ae3a64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.77.66']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa80a60c-3fb8-4eff-85c5-008f63845277", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.96.195.38']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da31b62-03b9-4f98-8a12-83695f823be5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.183.189.135']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20851a2c-3bc1-4b65-beac-15c595c27d59", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.168.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c6c0f8-4637-4e0d-98fd-4ed698db19c2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.141.210.172']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77ed316a-203a-42f7-97b8-c874958e151f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.112.188.29']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5be6849-619d-483d-8a4c-495d2d080c6f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.214.102.139']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fbf6ec4-21c4-4317-b8d3-14ea6c3c85be", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.5.187.228']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e66f17c8-72e3-45bc-8805-d08ec74283fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.0.32.55']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee351ca7-8613-4a06-9906-1904d8b85398", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.124.204.153']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b534dae4-6175-43a1-9397-7f6561c11877", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.164.173.203']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0601d210-d5bd-4688-be6c-4e3b9150646e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.184.98.211']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27ab0f4-0c12-49bd-9d4a-fbbf89235b4c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.113.234.187']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cb068ed-1173-44ff-8705-58cea4ed8568", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.126.170.255']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f96a7052-082e-4944-b4b9-88434f2edc86", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.139.160.68']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e984f3f6-2fb5-4523-97b9-e27d45a18398", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.180.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52e5636a-3573-4123-aa4e-fb1c9c648696", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.228.37']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d0fe63-d244-432b-99fc-05d96a8fffd8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.242.61']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03fb8a5-47af-4cbe-b1b4-a3b92bc4520e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61da5585-c400-401c-b59b-f9e3b037ac57", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.137.101.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c5b578-7ac1-4e08-8de1-7414104d86ff", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.51.12.60']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab586679-ac8d-4e44-b3b3-7f2df7b23651", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.20.54.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e623e69-60a2-4656-a670-05a6770ab1fc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.230.242.192']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--747ecce4-6ac7-4bde-9abd-f12ece2e0ab5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.121']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ded691d-6f75-474f-8f6b-9998bce60f94", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.41']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a7865b-e0dd-4564-a1d5-26a6d86f2f5f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832521c4-c4db-4579-be20-d4fec49630cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.5']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ad81ac-82a3-49d5-b8dc-0de04412ad03", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d712f43-fab8-4536-be2f-207546690680", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a3ba45-47de-48af-be7a-8766449ced0d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.5']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f25bef-a50c-4b83-a3d4-dff50d51bd95", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.6']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d770c335-ee98-4a3a-a910-0942fc6960a0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d56ca6e-313a-454a-a656-908ff5dfb06a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.10']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6231e71-3849-475a-b4e1-ff0bce5345d5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.100']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db7ed5e1-3e73-4077-8263-f1b1b7960f7a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.101']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21924000-e2ab-4c27-90c2-221ff8b636ec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.102']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7219b81-35a5-4b25-ac6c-f5eef52741f0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.103']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354dae42-e2aa-4bdc-84db-d42fae223a81", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.104']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88df1f4d-813a-42d5-9ac2-132a06efd000", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.105']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b166b69a-e141-4d31-b37e-e5f991b14a75", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.106']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7a34a23-5129-45ac-b797-d38f012146ee", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.107']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0640eaa8-9b02-44f0-95d5-d9b922131422", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.108']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9169b4b6-513a-4131-a563-4dc8d2d6728d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.109']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5846adf4-de4d-4549-97ba-cb7f8ee0ecec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.11']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ec20d59-73b6-4226-b7ea-f1d3190d2a69", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.110']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27cb341-5dd3-4218-a156-5820fee92534", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.111']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9939bfa2-f42a-4457-8c32-18c6f4faad67", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.112']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0955a836-4f42-44fa-8c8e-9f018dec7290", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.113']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--716b82c9-fcb2-4d98-b9c5-4412e2daf38f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.114']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b2bff80-6172-4465-9521-bc1295786907", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.115']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd9ef2db-abe2-41ce-bf52-9413a89429b5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.116']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73473477-c01f-45e6-8ef0-c2a3e5b0a1e3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.117']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32ee435a-d3a2-4242-98a2-e8388c0fd0ef", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.118']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ae37f3-a9ad-4c44-8a5c-05d204f92111", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.119']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60f6532a-d796-48d3-a2ed-ee8725d666eb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2da1c6e9-7cf5-4b60-9835-2d474b4d1289", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d604ea2e-9c81-42e7-852c-095892682fcb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.121']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c07d9cbd-c5f3-4e30-90a6-1cea8de1adef", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.122']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16178bb0-34d9-4daf-8671-02766129fee8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.123']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--971264fb-326d-4425-aac4-bc6b35edf437", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.124']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0fa2a2b-fdfa-45d7-a7fe-0d602c8e5e65", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.125']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe701b6-a9bc-4b45-adac-ddd109d9ad21", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.126']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0ae264-9278-43a7-ba07-3db4829876c6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.127']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd7d91b5-236a-4d43-af07-a4d9e5bee945", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.128']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a63cb6ad-23d0-4207-a492-68966306ec85", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.129']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--313ee934-2561-418d-9606-62d3c3a75046", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837b2ac0-dc9e-4c05-aaf3-4f93d44eb700", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.130']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c269f442-6d14-4cfa-a7e7-34dbf59a7691", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.131']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab895138-0ec5-4af8-9367-0df42a745836", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.132']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84ebf5e-cc2c-4b9e-810e-96c5a385afde", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.133']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec93cbd2-cbee-4661-80ca-adbf46b3063d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4837696-8ac5-4159-9a37-3e76bdff17a4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.135']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6734a680-ab70-43c9-a6d9-d701de5f1c3f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.136']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c744fd9f-8d4a-4c9c-b8e0-6658b1b76d81", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.137']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eadf7b43-0afd-4be8-a66d-a4996813ecdb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.138']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7691fea-4d16-46df-a529-817f3a907532", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.139']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5df9c13-0ee9-4dfe-9ac9-fb6f5013595e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.14']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2ae81ab-0dee-4ad3-bdb1-c19c3ed4700f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.140']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f1e85e-4513-4df3-bf5e-cc89b6d24120", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.141']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a2becc6-a9eb-43c8-ac31-a9e62095bfa2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.142']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f41cf0d0-5893-42b5-8ae1-cb7a606088c6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.143']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d553a5d3-e382-49c9-a736-7d5bb7296d17", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.144']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82e1e4bc-5b39-4ea0-b077-525978dc51b1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.145']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21e04da8-2624-4edf-9ef5-3d9f35235de3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.146']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a805de7-dfd1-40e8-b10d-93d510a82088", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.147']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da1b2e5-fe63-49e3-b34f-3df3a657ccd2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.148']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--151ac0e1-671c-44bb-975d-25d62b446bd9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.149']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64ff00f4-fb1f-488f-9cf4-65fc245d69a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.15']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdb0fd34-e0a4-48b5-97ef-b245b516da95", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.150']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75164a2a-0e8a-44b2-a63a-66fc1118d9f9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.151']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fec2bd0-63d2-409f-9053-c40242ffb3d5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.152']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb363c01-db29-40f3-9e9c-c0eab16dc116", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.153']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fed7340-c630-4ae2-833e-67f36f454879", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.154']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a00b7a33-7686-45ef-a095-03fab410d033", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.155']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b929d8-c8b8-49b4-9a52-fcc5786d91eb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.156']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e198c08-70bc-43ab-b937-0d12f3972595", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.157']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a6e8380-6312-4d56-b5d2-6b068bbbe1e2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.158']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af4b7001-8943-4607-a679-4ed4fefb0a19", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.159']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af08f576-a9f5-49c6-860c-832c9c1aa8d0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.16']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a389967-69f3-4873-9723-ba6cf8000f18", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.160']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f908b8b-f0ce-4142-93d0-dd3a3e5dfc82", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.161']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8e506c-43f5-4918-a70e-062a7ce60b60", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.162']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dafb9c3e-2063-454b-a6df-408633bf0089", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7baabb12-6d22-43f8-a086-8782031f1159", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.164']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8626e9f4-91e9-440d-a30d-10ae763018b9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.165']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd6ca815-37ac-4b1c-bbe0-1bb2851fdf13", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.166']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d318bc-2d54-4dd1-aa44-e7a92713674a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.167']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff5aedf0-b0ab-4629-a0e9-38503994dd35", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.168']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b64d562c-2146-45fe-ace0-3ca09aeb64b9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.169']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3b8db5-881e-4a77-9869-a21137bda1c6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.17']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a82f56-6b94-46ac-aa5e-d45d6418fd0e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.170']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b09b65f-dd09-4e0c-a2d3-2879d60f1f3b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.171']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9401cab4-a35f-450d-81eb-0cfe5516855f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.172']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63c147b-96d7-4def-a3e5-47c95192d761", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.173']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daa1e77d-2388-49c9-a437-d0819d6dad95", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.174']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09db0f4b-6d40-4f72-97eb-87b3c0dd1ab9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.175']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c885a890-4261-4544-bd6c-5d7914452934", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.176']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba32b411-3dea-43d6-aed6-abefe4e74aa3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.177']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6b4adf-f727-43ef-b389-08e061f261ea", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.178']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db8a0827-c3ca-4137-be4f-711d02421294", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.179']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c02da756-f264-4ef6-aa10-cf99e9f74af1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.18']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a368d5-9b22-4dae-93c4-c3499ece4bc5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.180']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd698f40-b5f2-4f0b-93e9-2416175b8269", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.181']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45cb37e0-097f-40b1-a472-53a9c60eb0a5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.19']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e930d3e0-fee3-4bb2-914d-e8e329b0ed90", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.194']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4efd149-372f-402d-80b4-0c9b01dda5cd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.195']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75fde9f9-b9ad-4ce0-8dce-b0d24ee9acc4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.196']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb2212e5-1dbc-4c8c-9c6d-5b524fc423f4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.197']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdadb15e-a093-4196-824f-fd619e2643e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.198']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25509ee8-fe30-45cf-8d4a-8cf7cc9c21cb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98ce05b2-4fbe-4b06-be7a-dae0c789fe20", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.2']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--804eca06-ee46-4900-8e61-0cf0ea3a79eb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.20']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45de40c8-653a-42fc-82d7-2958813a4d16", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.200']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dee0fe8-0b48-4345-865a-5abcf15319a4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.201']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af6ba5d-7af5-49c5-a2bf-2aefdc377793", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8afd7a8-9572-4096-af53-207238ce24dd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.203']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f7a4b4-5034-414d-842e-aa33dda3fc81", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.204']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--861f47fe-3f80-4e17-adbf-d2bfd69195a6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.205']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--232d8d61-ed74-4e03-a97b-33f03cf6a1de", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.21']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a2c49fc-8331-4957-9e8c-88b0a2a66de9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ef88d2-44da-4827-9c9d-40ae1a20717a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.23']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38321145-d55e-4995-ba79-e161b34ec32a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.24']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8169408d-9a61-455b-9f7e-9913f2a58ee1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.25']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--807f9f7d-0ea0-4d4b-9c57-ced01cfab974", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb457dba-f851-4601-bdc4-f5fd36d8ba76", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.4']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbfa775d-f2da-44d3-bd20-b18d95adf06f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.5']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c094f6f-12a5-4141-a928-017ff6a36235", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.6']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--260082a4-c105-4913-a24c-4c69353151af", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.62']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04b29f8-d6b2-4678-9722-acf3f6e687ca", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--526e1529-4ea3-45c7-9798-117cafafa052", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.64']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--599a3292-40ad-4530-a4cc-2f5bf28b264b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.65']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f51ae45-85b5-46ab-9040-42dcc8db3905", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.66']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0092e796-d938-4a65-a84f-2d784fb1562e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.67']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a38c04-0c11-4375-99cc-f3062ce5edf6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.68']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8405c4-af90-4b31-a29b-a548a7109a36", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c977841-a0da-49ad-89ae-13805604422c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c72c54a-8d41-4dee-8185-230093632779", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c862dedb-941f-4899-ba0a-18d2bef95aee", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.71']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ebe4db0-6ce6-4259-8c51-b57f11045dbd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.72']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b4f34f3-2118-4c9b-8c3b-18e7e4718052", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.73']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884075a2-37fe-4151-8440-24e4ef499987", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.74']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--481804cd-31a6-48fc-ad79-342abd810269", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.75']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d22aa8ff-f3d3-44a0-82e1-2199d426e0a0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.76']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d2dd905-90f4-45cb-97e2-8efbfb898992", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.77']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4b8d922-bcb8-495c-a57d-eb9b81ea0cb5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.78']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0008fe0-e729-4726-9754-d51bde217619", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.79']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f84d9aa-70ba-4f5c-96f3-22791c97bf9f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.8']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--866e6edc-ddc6-46fd-af84-9630e7a7e684", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.80']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ff313e1-833c-48e2-86f4-67cfa80020bd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.81']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f9e9b8a-eb27-4a82-8a26-20ecf1229eb0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.82']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--945436f9-e0a1-4830-87f6-6f6c58a09004", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.83']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8806c2f7-870c-42ac-9d00-5adcd16bb886", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.84']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ee079a-2d3d-4412-9e03-26cb49eae66e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.85']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1e13f6c-4732-4383-a85f-1a8071d87675", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.86']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f080c8c8-490f-4cd5-87b5-2eae5c8bfa66", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.87']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e288218-620d-457b-936c-fa920cf67b27", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.88']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1084615-81b5-4c3e-b49e-1b898c9e6ed5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.89']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f9c78b3-0d23-4cc5-a37e-7e3778accdf3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.9']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b044e21a-2f5c-4eaf-8167-63a47043c468", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.90']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b4215f-55aa-4bf2-bd49-0dfe9d4652e3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.91']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f70f93-d952-445a-af14-1611d922c4d0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.92']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbbd9ac6-df7b-4478-b9f4-7379ea418181", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.93']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6389fd73-622a-4073-84b5-9f751d58523e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.94']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f59864-674a-4966-93ae-c53b2e9140bc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.95']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aa5af8d-da8b-44e8-9838-c4dd1f0af355", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.96']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6077465-bf76-4bf8-8644-82fa3c8a8fdc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.97']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7518433c-4be9-4b23-91ca-9b5605f233bc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.98']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd642066-8bdd-49a2-9181-efca2353fe67", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.99']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f6fe97-f641-4513-b7b5-92467e680542", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.91']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa220625-1cd4-4096-9c37-27a72eca459b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.131.88.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63d788e7-e7e8-46d7-81ab-1f12739d2a7a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.42.52.210']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76eb80d4-6bc2-4ee8-a239-65e8d067feed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.112.98.75']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50ee99de-1824-40f1-a1b3-b407f802cdc8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.116.235.206']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7151d07b-0a4f-4d0e-8ecc-b84b528e0715", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.127.255.231']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a492bccc-1da1-4bda-8f6b-3273a2367625", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.135.57.163']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd05069d-855a-4b3f-89f0-c30791b32be4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.154.187.220']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02092657-2627-45bb-afed-01497ce6208e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.169.101.216']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad0858dd-c849-4b2a-a79c-53c8404074b6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.202.84.83']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d0299ff-ad64-44cb-9302-a8f6031fb652", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.213.78.129']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e13e7e25-99d8-4f9d-9dd2-214409cc64c6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.238.70.32']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a08ecf1d-6a92-426b-9502-a7333f0e6c2a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.239.173.23']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d5d1bb-bb38-4550-9ace-bb159af80a71", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.15.179.33']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5082333b-5ee2-45f7-8022-d796d133c7f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.217.145.188']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--503cda4f-b4e7-4755-bcff-da39ceba90d0", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '8.235.63.34']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae835225-7383-42fe-8f89-cab8783eb738", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.108.11.64']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99db0c04-4f55-453c-b4de-d752c5cec1d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.14.49.85']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ed66cb-1f66-4da1-a644-1c0d5832ea62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.193.174.3']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9215fda-5ae4-4545-bee9-70c0f0e67232", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.211.141.185']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b70ad6-7ed3-4525-888b-798c6298ebdd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.52.152.8']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c38a25d-4cc5-4db9-90b6-1856e348803c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.234']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e3ffd74-efc4-444a-99d4-465f1e84202b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.55']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94e638d7-415f-4454-9f55-bbfdc922ea29", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.211']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b1aa9fe-ac70-4d2a-a3d9-af6f35996d48", "relationship_type": "indicates", "source_ref": "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "target_ref": "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e371fb9-597d-4a47-8527-01af5f787f6a", "relationship_type": "indicates", "source_ref": "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "target_ref": "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--006b903d-8aec-42fa-91f2-eb2a8239be84", "relationship_type": "indicates", "source_ref": "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "target_ref": "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7df10cbe-15f1-414e-a7d1-29ed153257e2", "relationship_type": "indicates", "source_ref": "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "target_ref": "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4462baf-6e3c-46ac-bbd6-5eb9197b7167", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.205.110.235']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--830710ba-167b-480a-b7b3-f073490eda17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.214.126.155']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b96dea-9d82-408f-886c-a01b7995010e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.229.65.167']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb033612-7e20-47d3-8377-4b66ebc44b65", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.240.100.243']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f181d465-ea12-46df-8f92-76b9168ad9b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.244.175.143']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149756d1-6a66-417c-bfa4-c434fa5a0bc8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.56.230.213']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a0088c8-4945-47e0-b28f-eb14d3f065b2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.127.21.135']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73afb53-73f9-4bb3-9343-03672b8d5718", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.13.80.58']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054a4096-a15f-4a7b-8e97-9526a3a9d22b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.39.27.216']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541a3016-e445-4046-8cf1-a9a5db49fd59", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.65.200.137']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--566c6245-4256-47d7-aacb-11b58eda5b10", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.66.141.85']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7bdcb9a-4830-4626-8864-f679a04f4393", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.66.69.25']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fd32b89-50e9-4b73-b86d-619725e9b97d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.77.100.208']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4b674f2-18b6-465e-b511-8102f05a577d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.96.151.112']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9db70e13-8535-4696-94ea-a10d332e4ae8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.96.167.254']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2027c26-2849-4538-b380-501109e236cb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.110.107.128']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1136ab93-8abc-4e5e-88c0-23cfec1e0a50", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.195.136.235']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--105a1528-6ad4-4685-bc94-e142bf7a7b1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.217.213.120']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d0959eb-fb52-4bf2-a3bf-f61ed86e535f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.32.171.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb515663-6447-42e1-b345-c737daffe178", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.48.72.1']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9448b32-4079-4e80-a48d-ee4c14995e3d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.99.58.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5475a06c-0cf9-436a-af81-0ea7bf6acac4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.106.240.69']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32a00c5b-6ead-4b40-955a-dc8d9c4ef6db", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.15.219.99']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--250a4fbb-cbae-47e8-ac3e-b527b737fa05", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.172.0.239']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f508ba95-5e81-4f9c-9354-bf50f68f1d5a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.188.154.128']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e52092e1-4bc7-4bdd-978a-03081cdd777f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.32.220.100']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca3e0253-882c-426b-81ac-87b7659a2174", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.37.231.114']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--141c85d6-6314-478e-991a-51284f61e207", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.86.64.46']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dd9c23e-96d0-4487-a99d-6e75da8d2e6d", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd45877c-d3d9-4d13-bbce-db0132f05c3e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.199.79.131']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5d4354a-7f4f-4472-bb5b-d1794fc1cada", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.206.87.102']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0b411d4-eaa2-4fb7-ab88-d4925a3c1c80", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1b7c6ca-ba48-4b0f-b60a-796afeeeb460", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391b48b0-4667-498a-923f-de04835a656f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c3a2f1c-e85a-4649-9c70-af93f6464739", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f9a454-3596-4b0c-aaa9-468cd91bc056", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35180f55-905f-403e-93b8-0f8b21fe4e96", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7fb018-c140-4eb4-b190-c7f5ae1b83bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d72287aa-9dde-4465-9bd2-f40d16774194", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6935ee54-f030-4dfe-96c1-4a81d88874db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58cb1183-85c4-4464-93ea-ee59f26c7c53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a0e442-e337-4312-8506-3f23bdb76cfb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6f8d4e8-ce04-4448-bd8c-ee5f0667299b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9509306-abcd-4719-b33f-3795b1de006a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--107650fc-b81b-4413-9cfb-3f622521c3f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8344c885-dba5-4b33-8668-493b986a00d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd50a3d-45d0-4b34-b0ff-9dd2080fb97f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08be91e4-cd76-439f-8c61-098104b4dd7a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0801fff5-6b74-4022-9c4e-fdeec00086d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8731ae65-5c26-4704-a965-73c49ffe26bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6fa47ce-72dc-480e-8440-d6e4995a39c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33efab7f-03f9-4944-9611-b978d9125fb4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.55']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61cef3b7-3344-4e44-a002-46182eed0467", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.56']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe3d479-bb0d-4cc6-a995-62e20adac30c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.57']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79303527-87be-49ae-988d-b4df9d176055", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.58']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f75c1e99-6269-4963-b2c3-b735f5500109", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.240.250.93']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e53b280-b4b6-4cd6-8dc4-06a5f83742ae", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.5.185.86']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31aa528f-0896-42f8-9cba-85e687453e2c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.210.83.7']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f599d54-b078-448e-bd83-968acd8f0825", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.58.21.236']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc8a06f-d451-46ca-aab4-804846ff25be", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.140.0.202']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dfe733e-6c81-49cc-8e39-bf759e8a9a4e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.161.212.74']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ee3e94-81d9-4f76-aa79-7713231aaad0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.178.43.232']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7f3f5e3-33b0-4d10-9a29-4887c2605313", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.19.226.244']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f42269-1d19-4625-b002-37f3fefc9730", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.85.235.186']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d44b472-5dff-4edf-91cd-6cac8c33b75a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.13.202.32']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9146cfe4-dec1-48fa-b28c-afdc7ee94c32", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.18.204.153']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c8f7a0a-7363-4474-8bcc-77773be89c8e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.21.125.73']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63cd466-7e82-4002-82fd-1b7150adb270", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.242.128.180']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6553ca75-3925-4275-9ece-11f3a8452d70", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.180.11.96']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d084e9cc-98e5-4594-80ec-eb51894a4efa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.239.5.14']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba78612-58b8-47a6-bb86-dc957975d83c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.250.174.41']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb155af0-47e5-4f1e-8615-9395d2439fa2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.102.17.82']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9461d3c9-6651-4531-b1e2-ab355db9a60d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.180.201.211']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e871a7-125f-43cc-992a-2212c216cec3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.35.76.80']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8721a3d-147a-4b07-aae5-a0c497eb6602", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.50.129.138']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b69dd198-de6f-4280-a755-4ef0df4c3e20", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.66.149.147']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8c77328-251c-47c6-9758-ac469bbb5ff7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.137.51.124']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11bca421-df99-4689-bbe0-75af509666eb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.137.58.95']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706785fc-7124-425d-a3ba-4b168fd683f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.244.233']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d92118c3-225e-4bd7-b8cb-ca62db3f52b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.180.232.219']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b58123-5642-4bc4-937a-33d695eaa336", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.181.139.84']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd9361e-00b7-48f8-9761-b832a6aba5af", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.182.89.115']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3384756-7e8c-4a8a-96ff-6d448cc5d323", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.5.121.183']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7fd370e-2138-498b-aacf-8b7f177a692b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.67.117.22']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152225d2-a5c4-43ac-b40d-aec7758c6bbc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.241.196']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4356c39c-0a4d-4351-9b83-57e1be650d32", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.14']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18763a33-c55e-4f43-9f5a-c30b30d2d260", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.148.106.144']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1335fadc-9c1c-4e11-9907-1b25b58b9886", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.154.83.180']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f79bda-ccc1-470d-a66b-8154132e5c47", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.182.44.84']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62ba161-9e28-49c6-bdf0-39fd4137e71e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.187.149.162']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b6556f-1b21-421f-9be8-dcccb8dca126", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '92.222.24.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc63d9a2-da16-43d5-ae06-c6e9f50a0d39", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '92.222.24.87']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d764ee-18e0-4fb7-9189-b39f7576cdb0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.47.46.174']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4596a1f-d639-4b29-8650-34b6b5717319", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.127.112.90']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--932bbffb-6a20-4498-afe5-f849c82d60e3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.163.118.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e11f502-9037-4dcc-a13a-798858cc119a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.93.12']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fea85744-f514-4e64-a4ec-50d62c36acaf", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.177.64.139']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00b9d90-19a3-4563-8fa7-dee580cc043b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.179.209.121']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f344702-3b5b-4fe2-bbab-94ae27e4a05a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.184.207.198']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc05b90d-f5af-4bb9-b87d-1a9ff44fa911", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.224.55.238']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff5a3ce-58ca-43a6-927c-b1dc1f84bbca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.51.98.234']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c75b8d1-250f-4f39-a336-8210a1541c27", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.86.191.142']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58cf1519-8191-4c5c-9fd8-c9c98f2bda5f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.110.140.93']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf1a80e-5eab-44e4-a1ca-a4d6670844d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.137.120.106']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b61ed17c-fe57-4540-b304-5960f56bf6b6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.154.43.42']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fb3856c-99d2-4fee-8fed-62d30152d7d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.154.43.63']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a307a0-3947-4425-b913-42ad8ae12cd2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.2.203.26']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--784e8dfa-3302-4e4c-b950-5a2aa6f4913b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.254.254.164']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe29ae1-9490-4c57-a55e-0ff858c6efb9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.174.109.199']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e64bed6-5e88-453b-9de1-34d4ff078815", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.20.104.67']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843a2919-8dd0-4146-a92d-c3b3283684dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.236.45.134']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc9019ca-9979-4d3e-93cf-1b0b071a0a56", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.25.62.200']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43b94030-e725-417c-9c73-b6a009e16c3b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.54.170.13']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94276aea-790f-4b9d-a407-918032272772", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.56.246.62']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20f6ae87-d2fc-43bc-b062-1f0bffda1ce4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.89.95.135']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82fb52cf-4724-4822-a195-5bdb44a6526d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.28.222.253']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--448ddc1d-72e4-4971-a758-be00d13defa6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '99.189.238.44']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5544294f-7885-408f-b180-0e3f60d7d7ee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '99.98.222.70']", "pattern_type": "stix", "valid_from": "2026-10-05T00:00:00.000Z", "valid_until": "2026-11-04T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-05-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0075699e-10d0-45ac-b458-2f125c6fc4ef", "sighting_of_ref": "indicator--1c788e90-d30f-4966-a4e8-384c043bc91f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7645ca6a-321d-4709-be6e-4dba5531f10d", "sighting_of_ref": "indicator--1fa3ee1d-0735-4b7d-9f8f-fe755ca050e0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9393e78-d68a-4899-b01b-bc153ddeea90", "sighting_of_ref": "indicator--ee593410-b324-4487-adeb-9f4c6be1d73c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948573f0-1042-485f-a027-52b69f47ea7a", "sighting_of_ref": "indicator--62065999-9c75-49b6-8950-f57d90cfc5fe", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8157f92f-8631-49d4-8eff-87a2a0499c01", "sighting_of_ref": "indicator--f4c3ac97-d34b-4622-b89f-03666d6f61d7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--445b71ad-ae8f-4367-885c-343ce8b4a07b", "sighting_of_ref": "indicator--c323bc26-ba4d-4422-b7cb-139e8ff2efe7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08054754-9a3d-4c8f-8f3f-32aaee869e19", "sighting_of_ref": "indicator--7ed528ce-c40b-449f-a169-cd3177584067", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e0780cc-59c1-44f1-9c84-76c9d4dfad27", "sighting_of_ref": "indicator--7d368e9c-fac5-4b62-be04-d7627e59e62a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d49acec6-3073-4dd5-b2e9-fd8f975d7c18", "sighting_of_ref": "indicator--310d37b1-764d-47b6-8b7a-39ae3b3d1b72", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7919ba2-c2ad-436a-8011-e338cf3aedf2", "sighting_of_ref": "indicator--115953e6-a765-4e10-a5ef-503e15c7b449", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e31498f-5722-48b1-9be1-5f6a5eb65519", "sighting_of_ref": "indicator--36452deb-3088-462c-b4b2-0c4742e23e94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aedcdcdc-3821-4195-b1ef-83ccbe8642d7", "sighting_of_ref": "indicator--9204065b-55ff-4128-b919-d402fa6a888c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e5a425-3e21-48ff-9dc5-d3d5b0543360", "sighting_of_ref": "indicator--87a6e2c5-148b-4da6-a8a1-48825de7d00a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904f1966-0fe8-4f3e-807b-73589749b948", "sighting_of_ref": "indicator--7ca16a1d-e7cc-4e5f-a410-8661e4c2167a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c6c6d16-7e9b-41e8-8e6a-4556cf05b922", "sighting_of_ref": "indicator--3cfb910c-bc2e-4ea6-b73e-d232ee195a4d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbfdd9d0-eaec-482b-ad5d-309fd87af429", "sighting_of_ref": "indicator--6bbfebc0-1bdd-45b6-bca2-89f909e49e0f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281d1118-5a5a-44c7-b3b3-d9635f3803b1", "sighting_of_ref": "indicator--1337c3dd-77ab-4bb9-b9be-ca5b24cb66c3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2aa0a8-b5d4-4dbc-8db8-1577f465813c", "sighting_of_ref": "indicator--6da31cc5-6030-4f57-be1f-27ec148f8252", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c52353c1-1466-4f51-81b1-0a89f45b2567", "sighting_of_ref": "indicator--5aefcddc-f63c-4792-af61-15c86e0d7ae5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f84cb67-7867-4e47-89b0-3f9c4b1eaa4e", "sighting_of_ref": "indicator--7a487ba2-7403-4b33-ab1c-3a39075cbc21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7668d3c-26d9-4385-bc95-ce5ddf8ddd5b", "sighting_of_ref": "indicator--b3349855-19fa-472f-9e40-46ad10a27957", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f4a8f5e-6001-4498-a51a-c4502b38cb33", "sighting_of_ref": "indicator--dbc86e0d-fe04-40b1-81b9-77ce71238e3f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5e3313d-34eb-4834-a00c-f0e6e1b1b277", "sighting_of_ref": "indicator--fe8edd9b-ff34-4010-9fb0-da2de6ddf5ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--665e2fcb-9c0c-4104-b459-8e2952e31bb8", "sighting_of_ref": "indicator--a8d3911a-a4ca-4c97-a2e1-4dc693c35b7d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cad4402a-edfc-4014-a523-4122f8e84dae", "sighting_of_ref": "indicator--72ef60a8-7403-46e5-a91e-a20f61328bba", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97275911-1bd5-4ef5-b267-cd1eae6c9eca", "sighting_of_ref": "indicator--54e35913-ecb5-49a0-9a9b-ad3e938f26a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4dc951a-7c2d-4748-b55f-510a0809e614", "sighting_of_ref": "indicator--6105da02-bcce-4559-9680-2762c80a6293", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2debf4a0-981f-485f-a69d-1d021a6edff9", "sighting_of_ref": "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ef7569-6197-4e81-b0a5-aa5148d903af", "sighting_of_ref": "indicator--64a5ce77-e3ef-4b61-8c59-d2898673e664", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d4210ba-cdd1-48cd-87e0-41d267e135a0", "sighting_of_ref": "indicator--38c35ccc-d906-417f-892d-f3a376d30f92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c5c832d-7ed8-4146-8f15-e9249887f68d", "sighting_of_ref": "indicator--89af7f33-8129-4252-a746-8631320d064a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a32dd878-0b4e-4d24-a645-8b270e58fa4d", "sighting_of_ref": "indicator--31dc1bb2-3e06-44a6-b576-926a38f55555", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cdf21e6-0ce3-4e61-8feb-d2f7a5d9cc0f", "sighting_of_ref": "indicator--76893952-26df-4804-9956-2c3072e508a1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c884d540-e32c-44cb-b488-691e7ea99fea", "sighting_of_ref": "indicator--7bcd400f-6a2f-45f1-afaa-74c6e280f14a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b6d959f-eed4-44e1-8c83-1f5fc5f864e2", "sighting_of_ref": "indicator--aac4a3c2-1ad9-49ef-8c2e-9e9785021bd2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b61d7b1-abce-4c9e-83d6-6f71f6cba704", "sighting_of_ref": "indicator--4c92c47c-3b1a-46d4-beec-7a73b1a69ab0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aadab07-d8e6-4d02-8422-3ff5d520c35c", "sighting_of_ref": "indicator--eabe3166-a141-44da-97c1-6027326399a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--843f7798-6cb6-4428-9b36-39677683c548", "sighting_of_ref": "indicator--078ef465-8c6d-46c3-b4c1-d70ec56feca5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b4f316-5ef8-4650-abd5-4171220a6ffe", "sighting_of_ref": "indicator--eed28e64-d1ee-4ad3-a100-4fba92650da5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ce87a28-454f-4e02-a548-2fbb82adcb6e", "sighting_of_ref": "indicator--ec7fb4d7-775b-4681-b0c5-f3ab43c13d61", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b460f0f7-4d4a-4d5e-8790-1243b97f7d66", "sighting_of_ref": "indicator--838f8d5b-5ed3-4eb3-bba5-5834290e4936", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a26e5d9c-5f26-479d-992d-a4777abbb951", "sighting_of_ref": "indicator--d3dbc91f-99dd-4b36-a61a-475788268aae", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57d07b0a-a2ce-4981-a7d5-0872c5326f2a", "sighting_of_ref": "indicator--3cd52c18-5026-4950-965e-285c5b7ac1ff", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f99c3c6-d517-4b6e-8909-7953dc7bf1b5", "sighting_of_ref": "indicator--2df0ae6d-4b4f-4010-853f-d609ef657ed2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa370bf2-6a89-4847-9a40-2cbbb169067b", "sighting_of_ref": "indicator--7aad4bba-6d48-4967-a199-07258e1f54cc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d5f32b4-b44e-4149-abe4-304505be499a", "sighting_of_ref": "indicator--2cd4c0f4-bffe-4c58-a78e-0d0fa3355dce", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cb195a9-af75-4786-b390-6286eae12420", "sighting_of_ref": "indicator--978abfe3-5aa9-418d-87c4-9830be7bddb8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b262906-7ed9-4da5-b9f1-a3aac68b46e3", "sighting_of_ref": "indicator--b9ffcd81-63df-4234-9e70-50ec3b7d647a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47bacc3b-9680-4033-aee7-5f75f072fe2f", "sighting_of_ref": "indicator--11da9674-6270-44db-ba98-697041210795", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f18b048-3d43-475b-8a3f-94f2fd9293d8", "sighting_of_ref": "indicator--c2772999-de90-4470-9f86-73c48acd65e8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6c3bfaa-a36c-4016-a1aa-9cefb4339f6f", "sighting_of_ref": "indicator--fb88843d-6110-41f8-beba-bb9e7eebb9b7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b908d948-85e4-4771-a886-adba8e1cd184", "sighting_of_ref": "indicator--4a8cb174-cc53-4e61-830c-cbff9f809a48", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87c9a9a4-6379-496e-83ed-d504fc8e5331", "sighting_of_ref": "indicator--6cff31d8-62c8-4d2f-ac75-49d3af16354b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6768cff-bf06-412f-bf72-061d227cbb4b", "sighting_of_ref": "indicator--77180521-08c4-454f-8991-09f4e96685de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16307136-7aeb-4e64-8d48-97a8c2864823", "sighting_of_ref": "indicator--d3544395-2a00-40dd-8250-433d0d6b2e66", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--774b5c74-528d-4ee6-8a61-a9dfdf918973", "sighting_of_ref": "indicator--e53804c2-db0b-42b3-b4ed-ae978cd06409", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e73c75-79f6-46dd-b542-b0d6d8ab0923", "sighting_of_ref": "indicator--2c0176a5-93f1-42dd-a0f2-d200ac1bea72", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed73de40-e7c0-43ff-820d-6dc79b277031", "sighting_of_ref": "indicator--229701df-1415-4276-a98c-bb0a30eb78a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1683edab-41d8-4964-8a5d-a0acf283caa4", "sighting_of_ref": "indicator--be07f34d-e486-4fda-9fd4-5c065953223b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58afe390-80bc-48e5-bcba-184141fe4b94", "sighting_of_ref": "indicator--57fb28cf-8b2c-4897-a0e0-04483c9301d7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a38ec2b-0a93-43b9-b8e2-26d50febe41c", "sighting_of_ref": "indicator--d9f4478d-1294-42c3-a9c1-503711c290fa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb13613f-a4db-4751-aeb2-42ce232d3d97", "sighting_of_ref": "indicator--8b04a7fb-35b9-45d3-98b2-e131b8644ded", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--759bf79b-4008-48d4-89f5-c0b3d66e60ff", "sighting_of_ref": "indicator--ec9d70bc-fd57-483d-94a9-d1c62ad15783", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a3620d-8120-433c-be57-92d819033abc", "sighting_of_ref": "indicator--2ac13b3e-9c91-4113-94e6-aa356a61cb5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7d60a1b-9f0f-4dee-a5a3-3c5fc256d443", "sighting_of_ref": "indicator--5e5fb8d5-6743-43af-af2a-fe4dcb706f43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82aa730-650a-4c8b-bf83-5d88ee1902b5", "sighting_of_ref": "indicator--c7084dc4-e0b5-4588-a40c-7fcff8b28d2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce16be1-d4e3-4dd7-a256-434e33b18f60", "sighting_of_ref": "indicator--41dab32e-17ff-4f6c-af20-c36f4344a7f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092efc58-6e10-47c9-a098-0cebb3c96781", "sighting_of_ref": "indicator--0b6c8e8e-2b2b-48e5-8eb3-baf32ebbb8bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af97337b-b096-4112-b9d2-11b8dc0c0cd0", "sighting_of_ref": "indicator--1700e3f2-1945-4768-a4ae-bc5dbcd47ead", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec9dd71d-e38b-4160-84ce-05e0eddad0dc", "sighting_of_ref": "indicator--93eab4cd-9d77-4455-8d2a-d3df493a7d63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b7a091-100e-4adf-8234-b6872ae90c4e", "sighting_of_ref": "indicator--d1217b78-1d39-4b70-a4f3-5a020fbcb988", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c714c25-7831-4305-ac2d-e4d3f3c20668", "sighting_of_ref": "indicator--02f61417-cd0d-415e-b7f2-e8a48e84dca3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54c5e133-3310-4a04-a01d-79d65754f6af", "sighting_of_ref": "indicator--688efdae-2d48-4d61-8962-6ee142de030c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6033c2-dcef-4f66-805e-4dc9cb983709", "sighting_of_ref": "indicator--48807465-9812-4eb1-b786-b2b972fb53f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33251647-be0a-4772-9480-429e99c25bb9", "sighting_of_ref": "indicator--946162f3-7841-4ff6-91af-4d1411ebefdb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe2272f-a631-4889-a751-b3bcbf6414f2", "sighting_of_ref": "indicator--6a796800-d2e7-4851-9f1f-2e2a1f56ac92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06dcd604-8b98-4408-a684-8f3705feab7b", "sighting_of_ref": "indicator--c3950cb7-9e67-4f3e-9601-ca70872a76a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f8b3cce-0fcf-4315-8091-1afd34c4a9cb", "sighting_of_ref": "indicator--efec14b6-cfa7-47c0-8517-0ac804c4a52a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9a18cdc-05cc-4189-ad9c-ac56e75881c9", "sighting_of_ref": "indicator--aa90475c-7500-490f-9dbe-9af3dc5f4417", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb0c0efe-33f5-4d2e-bfac-83f2cd82fb97", "sighting_of_ref": "indicator--fb1fd99b-3628-4247-80a6-861875e2ab4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb71d400-30e6-4dab-abb9-03f9349899a5", "sighting_of_ref": "indicator--3eed1065-d72f-4fc9-9efa-febfa2f6c90b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd7ec44-da35-46e7-aaf9-e27300b3b092", "sighting_of_ref": "indicator--69eb5c4a-c619-4327-8136-f8718f5254ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21084a1e-3613-4c69-9844-62081daa1eaf", "sighting_of_ref": "indicator--3769f2cc-54ad-4ea3-af84-38a7be8a2dd1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f03a1d-b074-4790-aac0-2c77e81fad1b", "sighting_of_ref": "indicator--383c9bcc-70c5-4c34-a2b3-25111bdd3fe6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c6121ee-20c6-4266-82ea-734d7ac2272c", "sighting_of_ref": "indicator--ea0aa0eb-9a2b-4fac-b81e-1c275764addc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--336c9813-a873-4709-9c86-964c7d7e0260", "sighting_of_ref": "indicator--92249c03-b843-46a8-8f46-f2a129f683cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4824d475-6cb1-4a00-9ee4-d2ddcd0025fb", "sighting_of_ref": "indicator--1d047075-0a31-4dcf-a839-d211697cc501", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da68764f-584c-4aae-9bc7-e36111d4fb0d", "sighting_of_ref": "indicator--a0a1ee3e-12ba-41a8-ae03-24586d8665be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca208f7-134d-4088-b701-2fcc8198fc1b", "sighting_of_ref": "indicator--9b88f0f2-2d87-4cbb-82f9-ad4723a0eb97", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31f67740-d96f-476f-8def-a7a47c4e1e79", "sighting_of_ref": "indicator--c49a220d-4c92-46bd-b036-70fbdb1d4b7d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--020e64e0-bfaa-4c1e-a7da-9da98fd39a09", "sighting_of_ref": "indicator--1355c492-51f0-4099-b0a1-2eb5d612db15", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aeecece-80c7-4fa1-a58c-dbad61261aa3", "sighting_of_ref": "indicator--46b3b389-65ce-4891-a744-d4a01f628c50", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6f3763-2e89-42c8-a5f4-0ee62b4e84df", "sighting_of_ref": "indicator--0103362a-51de-4eec-ab05-6045808b62a5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bc762b0-2c4b-4845-b7ff-509dbae2449a", "sighting_of_ref": "indicator--ee04f536-5e66-43ed-9749-327393b1fc09", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c04c5b09-aa48-4873-81c5-631a4c1f16d8", "sighting_of_ref": "indicator--f03025b2-11af-46ea-bd6a-e43778e64eb3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10f3bb51-51b4-4cd1-a83a-73b4f675fe49", "sighting_of_ref": "indicator--85886315-f345-4d46-8fb1-1b2a1591f773", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1acb8b-5a1d-4a82-914c-dc306c778679", "sighting_of_ref": "indicator--e19cf0cc-f484-4db2-9047-c89771b3ef6a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3cb66c6-7073-4e4c-a954-8072579484bb", "sighting_of_ref": "indicator--bdeb54a3-9941-46e9-bd95-6d3acf7980da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d6271b9-808e-4f11-af14-62c011003bf8", "sighting_of_ref": "indicator--50eec09a-4cb2-491f-8b0b-9329a41ad1f3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc1a437-b7d1-4699-89d2-7a6fa233a6fb", "sighting_of_ref": "indicator--96e45c91-46a6-4541-986f-a928d94f602b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd7fe7f1-2512-4b9a-a32c-6ac3c77c47ad", "sighting_of_ref": "indicator--ee87b866-e839-439c-ba8a-003a505ccbc0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5fc7ca7-9986-4849-8338-04566539a8a0", "sighting_of_ref": "indicator--3100041a-12de-4692-acee-3d7d6f590571", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033cd01b-9ef2-4688-a20a-97790151ca46", "sighting_of_ref": "indicator--186d9956-4813-4cc0-8ab7-d6457313ba81", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f8b761-22bc-4642-bbe1-c8be5a202d63", "sighting_of_ref": "indicator--ac6f0b9f-ca3a-4877-b12c-fe1141978a54", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40688004-8121-42fd-b47f-0112a976e334", "sighting_of_ref": "indicator--87beede6-491a-474a-b8a2-21fe7f6650d2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c52ce6-6b72-4e24-8f2c-7db2100e6879", "sighting_of_ref": "indicator--088e50b5-a9e1-48fb-b6b7-f7d956228a5e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6841a086-21f5-47ea-babd-0bc7d8ea1e55", "sighting_of_ref": "indicator--f03c3be3-db60-4d3d-941c-c050a792f510", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d527e3bc-82ba-4f89-8949-1a3c341db887", "sighting_of_ref": "indicator--17497023-7512-490f-bf58-b8db6f39388c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc8ad694-de93-4b11-9f56-32ce9f077bd7", "sighting_of_ref": "indicator--aabc7df3-89f6-4a83-a787-bffd41249b8b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f529d73-49c4-4c92-9e0c-c23d1728a2ba", "sighting_of_ref": "indicator--ac75f9ea-ec6f-4b2f-908f-5df97769f6e1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c90974b-ff0f-4212-804f-812c09a78056", "sighting_of_ref": "indicator--e41abdea-59dc-4127-865b-40b1cf4f9979", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3414605-c498-4418-9126-67edfa6890d9", "sighting_of_ref": "indicator--d2900474-e1df-4b55-9914-3d26fe724d4b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c21ce1c-5365-4d6f-8ed4-0fbcdf74c3eb", "sighting_of_ref": "indicator--ade3a4ea-ac39-408a-bcd0-049be4d01829", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22bda3e2-6af7-495d-8b02-0a9b9cb1b1df", "sighting_of_ref": "indicator--83c21403-7a11-4b9e-a1d4-424d2ee92d63", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7516355-8591-4623-9e04-497395ac29a6", "sighting_of_ref": "indicator--fdaf1bd8-f609-4a77-a543-ad3c08c6551f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a82e8cd-428f-4e4a-bf1c-109cc5eac932", "sighting_of_ref": "indicator--a96d8e07-662a-49ff-a8da-4bd27ac35b0d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e91b0605-bce1-4ea8-b419-5d7ac5d7ead1", "sighting_of_ref": "indicator--41a9d5be-a741-40f4-a966-bc1d13ebb01e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afb6bb6d-0748-45ef-bf5f-7e9e332865ed", "sighting_of_ref": "indicator--11d38535-250a-4907-8754-f7a974ec0d44", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c3606a2-1b65-45f2-849a-4653db960fc0", "sighting_of_ref": "indicator--a3aa7ea4-6bec-4387-ab35-28a0bf9bfefc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6c58674-359c-41ae-b1ef-4884c70ecae3", "sighting_of_ref": "indicator--7a0df9f1-2458-4ecd-9388-fb202f70adde", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a65b2d7-03c2-48ed-90cc-8b41e50681f9", "sighting_of_ref": "indicator--23c69791-5e57-4e8f-a9d5-9f5dcf8b6be7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--285ad4d4-df17-49af-8647-31d6a0a2274a", "sighting_of_ref": "indicator--a9f19656-fcc0-4090-9152-6a3768657702", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc4a42f2-280e-44cc-8ed8-b1ced25e731e", "sighting_of_ref": "indicator--dd5c8fc3-303f-466b-8ad4-f64649c03f39", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb51811-e8c9-4be6-a6b4-0f8fb177a1f8", "sighting_of_ref": "indicator--d4a46c4b-719a-4a4e-96fb-964301dd6981", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56cbb1aa-4f64-46df-b827-5cb9064b8a7b", "sighting_of_ref": "indicator--a5da5154-aa57-4d23-abcf-0f3af6f74f7e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--052d3484-bb66-4789-812d-55f2c745ac04", "sighting_of_ref": "indicator--3ca7b882-a992-4bd3-94d4-ca5386611554", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52fa3d3f-3fbb-473d-8cd8-d3ee92c070e8", "sighting_of_ref": "indicator--7d58ae46-489c-4f1a-be10-7bb423c55a44", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8c1863d-ea6e-4fe4-a154-9a02d3af5110", "sighting_of_ref": "indicator--a645dd3a-6bce-4411-9ed6-2787ad05d370", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb31c31-665c-4bce-8082-3f9fd8020822", "sighting_of_ref": "indicator--68369a59-63d1-4bcb-98b9-8299d8214153", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39e9aa1-efa1-4bb9-8d35-fd7b90ebd2f5", "sighting_of_ref": "indicator--d47c7e50-e9e4-44d7-abdf-94a17383f430", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--416ae2ce-a66e-41ff-83b5-d4937ac19830", "sighting_of_ref": "indicator--5681c976-f32a-4dd4-842b-94912f72d238", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--230b4888-1e3c-4527-ad38-356c04c45b07", "sighting_of_ref": "indicator--ea56f262-225b-4dd0-8d20-88440454e6ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b684514e-abd1-422e-85e8-5e99f8d4bb1c", "sighting_of_ref": "indicator--4d685ff9-c1b9-45d6-8939-015f12f57c7b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b417192-c3bf-462a-8f8e-b56defb4a477", "sighting_of_ref": "indicator--99f61efd-c4d4-4e55-be4f-329be12c1b51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f518766-4a0e-44ae-956f-a11b1235e383", "sighting_of_ref": "indicator--d29ed995-1f2c-4e04-8a57-71d387b0ea4f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac5b78ac-5a4e-47f4-b68f-3c65ec4810a7", "sighting_of_ref": "indicator--884a8b06-d5d0-46f3-b34b-861f8da61f3c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed7b0bd-9a82-45be-accd-8f1403c8eb99", "sighting_of_ref": "indicator--7ac3b360-13ff-47db-8efe-47701df03403", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a737d3-a284-4728-b029-48c79d412909", "sighting_of_ref": "indicator--6cbea82d-2984-4c6f-9506-165ead21e63c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62f27b83-f69d-4086-95e7-c650d02bc719", "sighting_of_ref": "indicator--a97575e5-1b7e-4053-a912-92a7e95a790d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba7c5bf2-bb75-4870-88e7-c154a7ca10c5", "sighting_of_ref": "indicator--1b4200ae-492e-422b-af03-14677e9567b8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a041b384-09b5-4614-a39f-ce71670979ae", "sighting_of_ref": "indicator--42d0776a-1605-44c1-a5f6-6f84f702ffeb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a197e6-5cdf-4d78-b63e-c73b3a27cce1", "sighting_of_ref": "indicator--167b3b57-ee03-435e-9ab9-760f1b39c401", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73dff712-8d9d-49a1-af9d-7c4a559c8614", "sighting_of_ref": "indicator--d82a5dc0-7719-4d23-86fd-d6f50c3c269e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79c37359-41bf-4d1f-85e0-83b4a5151918", "sighting_of_ref": "indicator--d2be9c84-22ff-4253-bfb0-d8a7d8eba858", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c451275b-bbff-4dcd-86fa-9e048dce075a", "sighting_of_ref": "indicator--cf523495-19b6-44f1-bf64-806dcf71b997", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9e1b594-6326-4370-9868-c94ed00f7c98", "sighting_of_ref": "indicator--44546e43-4fb7-4022-8e4d-bdffa5c26ccb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ab2200b-2d6a-4a4a-934d-3137377b2ac8", "sighting_of_ref": "indicator--711f7267-7850-45ac-9662-ef0a8cabf191", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31b9a506-8acb-42be-bc15-957d64c695d1", "sighting_of_ref": "indicator--f944aff7-9ef9-472b-80f3-9366e47d572b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8956e700-e2be-46e6-8c19-9b3762a0e0f8", "sighting_of_ref": "indicator--cb1ea2a3-433d-41a1-9940-c24a16df36f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8b739d-e8b4-4bf5-bf9e-01b43782e4dc", "sighting_of_ref": "indicator--888c2c81-18ee-49e9-977f-ac8d67a40825", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c442fda4-0c40-48ae-84ae-4d7a8aaf0c01", "sighting_of_ref": "indicator--b2cc45fd-85a4-445d-8b25-df6af8e6e342", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--153d6366-4147-4d99-8de3-3b2a503fe39a", "sighting_of_ref": "indicator--49583b2e-5061-4d3d-adf2-a88d87f59677", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--302c76df-d655-443a-87b9-1111c836bbdf", "sighting_of_ref": "indicator--8b4ff66c-3f4a-4707-aef8-70ce63abdf78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--008e8fb3-b44b-4197-91c4-a0f36673fd29", "sighting_of_ref": "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045d8789-a189-42b6-a08d-dff9a14c623c", "sighting_of_ref": "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05d0f0c5-6c9a-4962-9d20-a48a214b1829", "sighting_of_ref": "indicator--60e8b465-d70a-45f7-8fe5-f9e97e2d7848", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64379ab6-6926-4789-ba0e-b079e7e11ee6", "sighting_of_ref": "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c3f4b5-66fa-43b2-b332-1eb8570f3b49", "sighting_of_ref": "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5efa653e-e241-4c26-a472-beb9dabe8fe8", "sighting_of_ref": "indicator--4f4c19b5-8f60-4e95-847c-ac2a98102392", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0a4e03-4726-4d2d-b4f4-2cbbafd34d3c", "sighting_of_ref": "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f279fd8-d3bd-41f9-90d9-88c63ebaa143", "sighting_of_ref": "indicator--2036033f-197c-4623-b22e-45e346a5dd44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6b177fa-bc1a-4a3b-b073-0a15a7b81208", "sighting_of_ref": "indicator--2036033f-197c-4623-b22e-45e346a5dd44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e8d86b3-b5e0-49ec-b84a-9d1494356b42", "sighting_of_ref": "indicator--aba526e3-6ed3-40ce-943a-346b68c25b60", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--895c74d6-3353-43ec-813f-8f617a5a2680", "sighting_of_ref": "indicator--49c6633c-ac95-4ecf-a490-d244c183f618", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c274b8-0020-4873-a9f7-6c14afe2cdda", "sighting_of_ref": "indicator--be04f8a8-51fc-4402-80a7-ead21073747a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8815b062-e321-4f91-9866-065e764b05b2", "sighting_of_ref": "indicator--323e10dd-3205-4611-957d-ef9c2a98add7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ff1a0a2-7ceb-437b-a0bf-15128469703f", "sighting_of_ref": "indicator--ea7ba9a1-8a23-46fd-9923-1614ff63dc22", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dbb227f-1fc7-4cd1-b339-666dd57acdf3", "sighting_of_ref": "indicator--4e825016-d1f9-4612-84e7-49f6e1d1a111", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6dbc10-81bc-4794-9a4f-af38447f0187", "sighting_of_ref": "indicator--4386b2f0-6f72-4b32-b772-b29a7a6495e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72f63632-8008-4779-a22a-f32fd26658f7", "sighting_of_ref": "indicator--e1944a50-5ffa-45c5-925b-9616f3a79d15", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffced2e0-1dff-48c9-8532-dd3e7ac10a42", "sighting_of_ref": "indicator--88dc3797-60d3-41e4-90c8-9851a70d9336", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5800e3f-ca0b-4f79-ac5f-9a650b3c0228", "sighting_of_ref": "indicator--089e16a1-aaa0-498f-8188-43a998571ee1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78f26f3-7803-4d7b-8a00-cca6c1aea1e7", "sighting_of_ref": "indicator--356f2393-326c-4e85-acc8-e50c146e7a0c", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6164872-f64b-4de3-8312-b0d10d9fc4e8", "sighting_of_ref": "indicator--98549d47-e451-43af-a804-05c481b7b06f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a6c4229-f812-43a0-826d-66453684b30a", "sighting_of_ref": "indicator--dadc0f2f-db3b-44e5-a221-9cbd95fd39df", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e367ef1-a199-44c0-a103-f30407fd71e1", "sighting_of_ref": "indicator--f9024cb3-d832-4cf2-8709-60a39f067ede", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf885390-7d10-4c0b-947f-95cad8a1534d", "sighting_of_ref": "indicator--844f103c-a07e-4f28-bf50-7336be53f305", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76a3d8d8-eeb7-4204-9e67-145f538b6063", "sighting_of_ref": "indicator--a7ba933b-69d8-4b8e-b7f2-d65f2b16352e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84288afd-3abc-492b-a6e5-bcf7ffb87c1c", "sighting_of_ref": "indicator--e3059fab-2be2-4a23-a51a-2f649786de7c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45e6692a-f952-4559-850f-3b9b248acd50", "sighting_of_ref": "indicator--06b88f85-d851-439e-b09c-6f23c08a1ca7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b575fa3-2300-4303-94b7-dd12cd6068ad", "sighting_of_ref": "indicator--29625a5e-f312-4451-ad47-4b7e3893454e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011eb644-fecd-45c3-a4ff-b5b74afccfc2", "sighting_of_ref": "indicator--a132b640-10a7-4876-a5c3-41e8688b0262", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20bdf29-74be-4f8e-bd45-c347a168f1bf", "sighting_of_ref": "indicator--803c5bc8-bd50-4ff7-94b4-04fdda3d156a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a679a9c3-8666-4d74-87ad-856b06177ee1", "sighting_of_ref": "indicator--cc249ae0-22f6-4235-9a4e-113e14e0a6a5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a069258d-7f72-44f6-8377-0ea079c86c2e", "sighting_of_ref": "indicator--74a69120-7df9-4cfa-8d8d-09e90a29b9f7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff4b5e10-342b-46e5-8cc3-1c9a44054885", "sighting_of_ref": "indicator--dbcd9aa7-e67a-4eed-a2ff-7f593d1fe6d3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e22b3d99-f690-4328-bbef-e6c0aed2a1bf", "sighting_of_ref": "indicator--38fa3797-bec0-4f26-92e2-02458b005a76", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd0e9316-87f4-40f9-a121-b224fe640f7f", "sighting_of_ref": "indicator--a236e0bd-f121-41a6-972a-98eed1cec8f2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b008802-c94d-4c97-b891-858888362370", "sighting_of_ref": "indicator--164b5587-8add-4a7b-a080-54d413a7cbb8", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04dc5f3-0707-4a91-8b18-bf487baa3139", "sighting_of_ref": "indicator--db0cba17-68db-4af2-a2ca-55cf5402a8ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af5d89d2-13cd-490c-8ca7-db261dc38af6", "sighting_of_ref": "indicator--24b53fc4-959c-400e-92fe-d978bf0d387d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ddf7fe7-b896-417c-9b10-35960d1c2083", "sighting_of_ref": "indicator--7a003115-5316-4e39-8cee-d7cefff29518", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeb628cf-90e1-4145-8010-7c5c88a7a981", "sighting_of_ref": "indicator--de1287eb-38f2-4d73-9f4f-46356832f6fa", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--850ae316-3af9-40a9-b48d-b88938e83a84", "sighting_of_ref": "indicator--a78a4af0-75a2-4dde-97a4-15a5e9158079", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77c6a3da-7e42-4b94-8359-a6c4e28668d0", "sighting_of_ref": "indicator--6377c35d-82db-4868-a047-aa3a71793f25", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39856438-50c5-4589-9fdf-54d16fac15a4", "sighting_of_ref": "indicator--4b38ba26-c092-419d-a30b-99394f785617", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b767d9-f8c7-4c9b-b596-5482ae0b06c1", "sighting_of_ref": "indicator--f306f882-c918-4a19-b0c1-758e38e25312", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74d9bd9d-c04b-49a4-a432-e05e86d090d3", "sighting_of_ref": "indicator--abbce5b6-3eaf-41d7-9e8d-39378a07b7c6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bf2e1dc-55e5-4d31-8eec-61b2836ddd9e", "sighting_of_ref": "indicator--698ab6fe-01e8-455e-9cd1-534671cc26c9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d6c0160-b496-4893-aa7b-74acccc3ce22", "sighting_of_ref": "indicator--d7367555-a863-4b7f-b02f-5368c51e3a15", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b98a797f-0f97-4490-8ee8-4bc8cbe559ee", "sighting_of_ref": "indicator--5554e558-c4a3-4396-abc4-94b6430c4232", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033f7622-7155-43fd-b8ec-fedb5e63686e", "sighting_of_ref": "indicator--445ad131-6df5-4528-8ae1-f3a6e4c056e9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--670fafea-dcff-47ca-b6a8-2347f2b0b66b", "sighting_of_ref": "indicator--91a985f0-160d-40e5-8f1f-50e4c2dbcc7a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538ad14c-f863-4130-8f4c-3aa2361e1ac4", "sighting_of_ref": "indicator--00fe555e-7780-4d4e-a625-ba60005c9234", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82110c76-29cd-4719-91e2-15fea10e9e5d", "sighting_of_ref": "indicator--258aebae-92be-40b7-b7fd-ac4e4d6629df", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd6b370-fbbb-450b-8e06-11a61159c0ab", "sighting_of_ref": "indicator--fcce8ab3-dc2b-4bdb-a2e4-d92429c4f369", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d1f934-7f79-4930-824a-7e728cd8d596", "sighting_of_ref": "indicator--7703dfae-c63b-4e15-8e64-387d8716a3c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b69313-0667-45bc-95bd-e1914fd38379", "sighting_of_ref": "indicator--e141c707-cbcd-4f61-8ccf-131dcc72cc47", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b631935f-5686-45d0-a774-513f0e625050", "sighting_of_ref": "indicator--41426ffd-5ac7-48f7-9b80-ac5f6de59212", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de642ecc-dba8-4b98-aaa5-1d1293c8a796", "sighting_of_ref": "indicator--119abf12-3693-4287-a64a-2b84733a6b18", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e36c1a52-35c4-4cff-8116-b4f278ebfd3f", "sighting_of_ref": "indicator--e567e75a-8686-49a1-85ad-27d9d9321b30", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e236381-d8a6-40dc-9311-3b38f14fa3b7", "sighting_of_ref": "indicator--afcb6afa-1d48-4d6e-ab15-c337c5c2ca82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a381690f-b589-4fb7-9148-ebb80d50019a", "sighting_of_ref": "indicator--e415b02e-b829-4272-aa76-e57d2705dd28", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00febfd1-d47c-494b-961d-4d07f22b9412", "sighting_of_ref": "indicator--aa9cd34e-f635-4e19-af91-984ef46e61cf", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b231fc-99be-42a5-b112-24a3da7e6fdb", "sighting_of_ref": "indicator--a4189942-4ac6-4c15-ab7c-e1a427b51736", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5968bd87-5e0a-4342-a19a-c2f797358c82", "sighting_of_ref": "indicator--229c42eb-2aa2-40a6-8142-a6003e51a4c3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d04d0a1-1d49-4516-8784-d77db0662359", "sighting_of_ref": "indicator--16cb137c-3f67-41ff-87e4-91c6a00906ff", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a74bc083-ddb2-4c70-b51d-eabdce5fbc57", "sighting_of_ref": "indicator--04a16b24-c87f-42ea-b7a3-c9e7d73300e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34009b7b-2ea8-47dc-8344-a7c4bd4abb9f", "sighting_of_ref": "indicator--023a800a-a773-47a7-8481-def6e070027e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8dafacc-a2f2-4a22-ba64-f1535330ae70", "sighting_of_ref": "indicator--e89d3336-1933-448b-a69a-7fe3271885c4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ecf207-8088-4984-99d8-9690d4fd5e26", "sighting_of_ref": "indicator--47d4523d-be4b-4d6a-9ba1-0ff4ea145736", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f0e81a-0ca0-4c59-a8f0-f77a6ba34e76", "sighting_of_ref": "indicator--5af188c9-853a-4227-aa6f-561799689aa2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e806d34-96cd-4fa5-9b3d-405ac8c02403", "sighting_of_ref": "indicator--57d9ab52-8aff-4c12-a051-0c1b840a2ceb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c68ea8-f081-4dcb-84db-fd5d13a72979", "sighting_of_ref": "indicator--f18e4164-858f-42ac-95d6-d6c37d7726db", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d22c4ae1-5c26-4694-95a9-24e13d6ba54e", "sighting_of_ref": "indicator--66161ed0-01d7-4517-bf1f-b68a5ceaf006", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deaf7f49-fa73-4feb-ba7d-a86763dec9fc", "sighting_of_ref": "indicator--6d67681e-aeb6-4656-b56d-9aed82508312", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--320664f8-7117-4be6-aa16-9916474b01bc", "sighting_of_ref": "indicator--d5680db9-d241-463c-b6da-6ceb155aba64", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9c4492b-0f34-4424-a078-abff0513b943", "sighting_of_ref": "indicator--a7190eb2-9fb7-485a-990d-c05f28f16f51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e3648de-d581-4194-9d05-52ad4b0ff9e5", "sighting_of_ref": "indicator--71b4b33d-3c1c-4933-a026-e31296530fb5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ed716a-731a-4b58-ac42-4741770050ca", "sighting_of_ref": "indicator--ace3eac5-4553-4ce4-89c1-5b2e5e752b51", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67460a17-e62d-4bb0-97f4-15f7d4224778", "sighting_of_ref": "indicator--9712d67e-9721-461e-a3f2-2ce5fd7cb421", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ed914b8-f252-4ce3-bc83-38a984d669e7", "sighting_of_ref": "indicator--9ec4d630-ac6d-4c6f-88df-b20c3c848f88", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4860a90e-5dfc-401e-821f-6ad6f3739952", "sighting_of_ref": "indicator--948d4b51-c735-4bed-bdb9-8b6ccd7bef28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--407ca673-0a60-44e7-a08d-9ee2f648c6c9", "sighting_of_ref": "indicator--9bb83ee7-2f6e-4a35-bbfb-123ef5075139", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bd8bd41-35bf-4b26-b936-8ebc59cf8426", "sighting_of_ref": "indicator--51757a27-99cf-48eb-9541-c3970031696d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5957fb8c-f39e-48f3-84d1-dcfa4584017c", "sighting_of_ref": "indicator--c065683c-3232-489d-a98b-c94f9c3ccd3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d394c927-6c1e-4cbd-ad0b-05d470cb7710", "sighting_of_ref": "indicator--eef4abf8-6ca8-4253-bb6a-6bcc3a7ba4f7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a24728cb-fdbb-4533-ab05-218884e9ed8e", "sighting_of_ref": "indicator--cb50461c-138f-4386-8dc5-01d1aba09e1c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95126b4c-445b-4b2b-9950-47e3107c96d0", "sighting_of_ref": "indicator--083e3334-dae8-46e2-8966-eb188950b5c4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d7d7aee-4a6a-4087-8f7a-6fe6233a0840", "sighting_of_ref": "indicator--eba9a0da-a6df-4abc-bc86-0e4c173cf993", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f448000-3f18-4abf-8a9e-f143c265b1e1", "sighting_of_ref": "indicator--2f6f9d3f-5b77-4c06-a1ef-e92a29eaa0e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7ba444b-29d9-4491-bb7c-ffc3a41904de", "sighting_of_ref": "indicator--351f360a-ea8f-47f8-a9c2-bf68836280d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55598508-0a9f-46ec-a54f-244d6ea9b548", "sighting_of_ref": "indicator--569157d0-9b2c-4775-a8b9-8935628cb5de", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c24d8b3f-267c-458a-8ce9-dc6dcda10905", "sighting_of_ref": "indicator--18073e8c-f50a-4253-b293-e1782feadb45", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aa8c082-f89b-483d-82e8-03fe09d8d774", "sighting_of_ref": "indicator--0cb7ad2e-b57b-47a7-b532-81cd1012190f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47244e4d-dd8e-45f3-9010-d1cf2a94834f", "sighting_of_ref": "indicator--c59ea395-3341-4ade-8785-d78b38f3f39e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b31469-45f7-4de1-ba40-77b16a3d4964", "sighting_of_ref": "indicator--9ba7eb71-5934-40b3-bf1b-824b5a6ba52b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ad1401-d88b-46d9-84d5-23f3947ff78a", "sighting_of_ref": "indicator--0f715c93-45df-4a1a-a69f-99b170bddd54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--583d65cb-55a8-43ab-90c1-4cc596f4abe7", "sighting_of_ref": "indicator--f53b7ee0-2394-4662-93c8-48b1a7358eb2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb87a7c0-ff57-4786-9fd6-dc1fd1548d8e", "sighting_of_ref": "indicator--c87164f1-0f5e-4ff8-814c-6f46421cc5cd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--690d5e37-83d6-484d-99a9-ee7beee074e1", "sighting_of_ref": "indicator--72cfeeaf-47a7-48e2-bb3f-8f16e06c89ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3af380e-e4be-4c67-a277-54e24d2947ad", "sighting_of_ref": "indicator--37bfb5ce-dd2a-4bd3-8225-bd9772c15671", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dfa7b82-6f9e-42cc-8dfb-1b7f7c6b1527", "sighting_of_ref": "indicator--f33f2592-9247-47a9-86cb-4d80fff594c8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--774d32c3-30b2-4e52-a9ed-e11bfc40e3e7", "sighting_of_ref": "indicator--27b4d59b-d74c-4e42-9e32-43bd04c12d95", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e03e9a-be0b-4e19-be52-9912f1d0be33", "sighting_of_ref": "indicator--db32d76f-fe47-4855-b70c-99dbaacbd879", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b3222c-6817-4b5e-89f6-4c86b289ac03", "sighting_of_ref": "indicator--b43c0fe9-7dc2-43b4-94d4-658d863f1f52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99ec26d-7ffd-4681-b71f-b2deccb6c493", "sighting_of_ref": "indicator--38b9b0b6-75c0-4b1f-b88d-8b1042e7c005", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--454a9f0b-ec5b-44f0-9506-6f27dba489bc", "sighting_of_ref": "indicator--71dfaf13-d2d0-41b3-8181-17a463aebbf2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a24d2986-5ccd-4906-b658-27c14745f5b7", "sighting_of_ref": "indicator--e33f3cc3-d34d-4aad-925f-ba6efddf14a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c20963a0-0cfa-4593-8c1f-f7d4aa9133a3", "sighting_of_ref": "indicator--8aa646f6-32d2-456d-a84d-e5bbb4364303", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73254e09-d7e5-4444-9c06-73e713e59a37", "sighting_of_ref": "indicator--bda201c7-9255-444a-8e5f-a18449173237", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b6b92f6-e143-4704-ad02-56c5a6b4c8de", "sighting_of_ref": "indicator--85ce1e3c-516f-4354-a431-b01b73b347dc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b264d35-3d5d-4ae3-8b23-8494e1ab2c59", "sighting_of_ref": "indicator--73557fbb-b0be-4ed0-87ae-fc9fbbd5c69a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c62da1b-f339-4fce-8b28-d52a65df8bf3", "sighting_of_ref": "indicator--08d5e059-c658-4fa3-8119-2277cdcc3cb7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--135624bc-608f-463e-b80e-fa97178f6a2c", "sighting_of_ref": "indicator--e839bc71-4fc7-49f5-8a26-b8aff6b425d8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7c15ba8-e96e-4c6f-8725-c700e62ad212", "sighting_of_ref": "indicator--0de7c142-7aba-46f9-8cad-4fa3d453f575", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ff7330-ff84-4fd6-8976-f06dc568db41", "sighting_of_ref": "indicator--2c97e9e0-64d9-4381-a0ce-a2b8a4e7242b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8befca1-9874-4897-b562-5bdce3f92515", "sighting_of_ref": "indicator--ffe4111a-94df-4dbd-a455-fc933729ab1f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac3e7bf-b5b1-4597-b864-6055d249e911", "sighting_of_ref": "indicator--24b8a35e-8926-4759-9de5-cbc65b5a7b17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d305533-7286-4df5-be93-32f229cb2ed4", "sighting_of_ref": "indicator--31b37a27-45fb-4e39-b78b-eccab634b27c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7451103-e3e0-40d4-8681-67ae0d6bc539", "sighting_of_ref": "indicator--0012bbe1-a5a7-4a04-ac60-1485c06a6e93", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3abca72c-c673-433a-beb0-936b79be178d", "sighting_of_ref": "indicator--61cec9b4-376a-4bd9-9235-057dbead7e87", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dffa204d-4a33-44b3-819a-a9bb63cbd965", "sighting_of_ref": "indicator--0decade4-23ed-4bb5-9c1a-b9f27eb7ad86", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8216421e-c675-4785-9d79-5424b7abe25f", "sighting_of_ref": "indicator--2965667d-3dcb-467f-a949-8b7991dbf741", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a43e4574-daea-401b-a85d-84e602a683c5", "sighting_of_ref": "indicator--15e36a76-87e5-4aa5-aaa1-523d3b3ca5db", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726f4573-209e-4a9b-a2de-b27c750e65ca", "sighting_of_ref": "indicator--17f9d74a-2b2d-43cb-963d-018561eb02dc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3052d513-bfc0-4d89-a897-2a86fe885cf9", "sighting_of_ref": "indicator--427c8bcf-f5a6-402d-bc2b-909fe8d08156", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8dc0ead-254d-4822-8c64-f4e240fc7d0a", "sighting_of_ref": "indicator--e624285b-ab63-43ec-8e02-5d7bd695b268", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68b1eca8-31ae-463e-b410-333b6a6cdec3", "sighting_of_ref": "indicator--c8181b15-8987-4270-82ac-1ec1ba0e1c40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7da1b43-c579-4c9b-bd75-d33c422a8339", "sighting_of_ref": "indicator--0f84989b-faf5-48ba-8c7c-d60946ec3dab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87eb53c2-d0ae-4473-9eff-a280c72bf1b7", "sighting_of_ref": "indicator--3e073a40-f960-48be-b4dc-8712a92b0f1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf44cf25-adc1-4295-9845-4d4f41e58bc1", "sighting_of_ref": "indicator--bada8cd2-6eb7-4d19-8ead-bc90f5e820a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--684e2c05-bf61-47bd-aaeb-f91127c379fa", "sighting_of_ref": "indicator--bcd72caa-a482-4f3b-a427-8ec8382e988f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--302aeb86-4739-4abe-b9fb-2775a67e16c1", "sighting_of_ref": "indicator--9b6e7345-14a0-477e-bfb2-2c32dc67c83f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f32d1b9-870d-4468-ad68-905405e009b4", "sighting_of_ref": "indicator--4d17ddf9-7912-45d3-a6f5-643996f0ed4d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e3c0b07-cb22-4147-83c2-a1e8000a39b5", "sighting_of_ref": "indicator--5488260c-0cca-4082-bf58-55894d1c88a1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0993b7cd-44db-499d-a9bf-f51de423698b", "sighting_of_ref": "indicator--eff16cd1-eac7-4d31-8536-ca8b15ca5f61", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c18dfa40-4260-4c13-a655-6baf82fa3354", "sighting_of_ref": "indicator--1e4e025b-19af-49bf-a50a-e070497758f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--046464e0-c00e-4dc5-82b2-89cd393a9a08", "sighting_of_ref": "indicator--a58aba91-a1f5-4e52-b8ac-cb8e6ecd69c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b6b035-fd52-4212-98cc-332a025cb89d", "sighting_of_ref": "indicator--6ddd19fa-cce3-45f2-bf41-654b570c03c9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c64730-8820-4041-98a8-3bdd274bccaa", "sighting_of_ref": "indicator--1f13347a-207d-4c26-b986-f13e4339a7d1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cdfb6cc-5f4f-4283-a13a-feb0fbe1eb21", "sighting_of_ref": "indicator--0a46f64a-dd46-407e-b8fc-baef6ea4db1a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb8faa12-8820-4d74-be89-27edb7f44d9f", "sighting_of_ref": "indicator--b2248ed3-3b99-4d47-a9c6-505655a22c48", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49e9997c-693c-4875-a266-aa799b6e3c90", "sighting_of_ref": "indicator--ccc8d631-c1b9-4c3e-9076-3cd84977f6d2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aea7bbbb-b2fb-4511-abda-5fd200cd721f", "sighting_of_ref": "indicator--884d893c-897d-4e7b-a586-b708cbdc5f70", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f155f5-d14d-48e7-80fe-81ef5b8bb645", "sighting_of_ref": "indicator--788f31af-4fac-41f4-b192-6ca862036c8b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5087d85d-e152-485f-b7be-903957127463", "sighting_of_ref": "indicator--a496add7-78c9-476e-b28a-9db6724b576f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06db10d5-fb13-4136-b312-e222971d6ea0", "sighting_of_ref": "indicator--b4171973-cf9c-44f5-924c-45059e9dbb2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f4158c-29f5-4898-9310-152b7a920aed", "sighting_of_ref": "indicator--d793f1dd-5268-4b86-9bcf-439cfb0a016d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea5fca32-054f-456a-9f10-5a365f624d80", "sighting_of_ref": "indicator--1537f061-2b10-40bb-9618-484ce452f2e7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb301fc4-f238-499c-99a4-b064a7b9c2ea", "sighting_of_ref": "indicator--c7109b19-e081-491b-9e32-8400814f3938", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c13d8a-5b57-4abd-a2b4-bd50cb0f7498", "sighting_of_ref": "indicator--7fc5e88b-9fff-470e-ac62-71193f51b954", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23810fc4-57a0-4cdd-acd1-a397696e08fa", "sighting_of_ref": "indicator--716b1800-a5e8-40d2-8ffc-7898b671d613", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c27513b3-7df8-4d3e-b06c-b0443d3ae5af", "sighting_of_ref": "indicator--aa42718a-34c5-4cbf-a60b-48579d0cf5e2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1294024-a9ae-4073-b683-40d2f1a456c0", "sighting_of_ref": "indicator--0933d634-95d6-49ea-8cae-360c19879560", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c171f967-f8d0-4d59-bccc-476c4242d4c7", "sighting_of_ref": "indicator--8fe2c895-e721-45ef-8b93-1c51fa41d44d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c8662dc-9beb-4516-91f8-d3721c16dddd", "sighting_of_ref": "indicator--3c47d565-63b2-4fe9-9f9e-2bb7af3724aa", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd4ba09-a095-42ad-9902-bb121b0eef99", "sighting_of_ref": "indicator--1a54924c-f1e9-41f7-8257-dfbb9c1a98c9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8474ac0-8925-4edc-acfe-60c5ed7dc45f", "sighting_of_ref": "indicator--1b73ba3d-ba69-4759-b22b-f9df2f9cece6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10fbeea6-9c28-429c-96d4-860fa8a4bfc3", "sighting_of_ref": "indicator--e14e5b76-f995-4e64-9857-26a6c5482405", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4006f01-dbce-4e61-a5d2-401c50fabce5", "sighting_of_ref": "indicator--767fb29b-931e-4dfe-8bda-8f4bd27d154b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de9bbf3-0179-4767-892d-2b0b28a897e3", "sighting_of_ref": "indicator--6be03840-2f5f-4999-bcdc-ff36b063b962", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c460477-2c50-4b38-9d1b-b5cac423bf4d", "sighting_of_ref": "indicator--c668bd71-8b1e-4b42-ab33-53b0cc1e87ee", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--284d50b3-8964-4658-8277-ffd068aac3c7", "sighting_of_ref": "indicator--83c61999-8bf7-479f-bca9-234f811288e3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--832598b6-e814-48ef-91d0-cefb75fcef92", "sighting_of_ref": "indicator--8b32d6f5-7e4b-4755-8c36-3e0b92c56f4b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f7aa112-7aea-4149-ac88-83e73b6ebf1b", "sighting_of_ref": "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a8e673c-4fad-4409-a6df-047b908ebce7", "sighting_of_ref": "indicator--eaed1383-1106-4670-9d62-3bd13ca4f757", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec0c2ef-f50f-475d-a9d3-daf6b3ff0f72", "sighting_of_ref": "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbb29c4f-d167-453a-91aa-c1224037af55", "sighting_of_ref": "indicator--eb54fea6-fe6b-4e29-8c62-26cca4f3344f", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311b581f-6a4d-4e31-8301-ddf8f3ce3586", "sighting_of_ref": "indicator--f54d1687-4f37-4c5d-b430-5f72cfca47af", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe9280fe-148b-493a-bf97-c9bf01b3b453", "sighting_of_ref": "indicator--11461990-b446-4c97-be70-12a0a7045f69", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6feea686-7e52-4ef0-a201-9b0f4d9fa04f", "sighting_of_ref": "indicator--5182423d-544a-4476-8fe5-5c8635388ed7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94a1944-275f-4f0c-ae3e-ab170580c15d", "sighting_of_ref": "indicator--ada6d8c3-f645-4595-a910-fe1a3b695e01", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad8a0afb-c714-4d37-9375-e8067208b98c", "sighting_of_ref": "indicator--4eb7ed49-55bf-433e-894d-f54bcc6b52db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7f37054-c984-4443-92c2-95c9058708b0", "sighting_of_ref": "indicator--536c5b7a-5c42-49cc-9737-0ad6eb444141", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f0304f4-7ad8-4763-bfcf-24081b480e1b", "sighting_of_ref": "indicator--b3c53764-af93-4a78-a9ff-5263f174934c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38de40b6-1032-4271-ad72-4eed51f2b715", "sighting_of_ref": "indicator--f31b9036-d42d-433b-a650-989a1c0f21da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a9c3b9b-95af-45d5-b7ab-6160b8bbe22a", "sighting_of_ref": "indicator--59c46837-4b0a-4160-92a1-1c5d551792cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bcf0055-8af6-43ec-a01f-7d03cd896d5f", "sighting_of_ref": "indicator--0c57df7b-3e64-4f1a-bef0-7aedc3c2c3d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cbf3a4b-c610-4f49-8bcb-2eab0782fe2c", "sighting_of_ref": "indicator--1d946aaf-00e0-42e7-9023-f328ef8c65eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9ff03ed-3d07-44eb-9008-109d98ee257b", "sighting_of_ref": "indicator--759983a2-2dcf-47f6-9aeb-6ac4b5157653", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2fc581a-2b4e-43da-9533-27358e55c53e", "sighting_of_ref": "indicator--4c746ebf-41ea-46fe-a2fd-24698809a561", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--688e1911-e960-43ee-9409-159dce0bedf0", "sighting_of_ref": "indicator--6cad04f2-81ea-4b0d-a4d4-ec5b0df448a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4821ff9c-bcd2-43b9-838c-d371cf5ba292", "sighting_of_ref": "indicator--39ab816e-c251-4e2f-84d9-11c86de20608", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd6da71-99bb-480b-9156-f025ad332b8b", "sighting_of_ref": "indicator--d6fadee3-78c1-4766-b840-0461ab8292bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--507ae8c8-a1a7-41e6-ab68-0c985a773471", "sighting_of_ref": "indicator--fb55e32e-a252-463f-b7b4-99b5eded6480", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfe35e3c-8dde-4181-a46c-0b1848db5b40", "sighting_of_ref": "indicator--ec47a20c-51e5-41e3-ae49-7db8c0b83450", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7f8693-a761-4fb0-b889-5f29b49179b8", "sighting_of_ref": "indicator--bc34c57e-27d1-4a5b-a64f-936b509f5e83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead4c2b3-daf7-49b1-ae69-0e9396110243", "sighting_of_ref": "indicator--96811212-8754-4bb1-818e-6bc57289a061", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2f6dd1-e9cc-4cab-82b6-89993ce76a7b", "sighting_of_ref": "indicator--06ca7c2d-9e22-40e4-8570-f04b7debf67d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2db79a1-b31a-43ad-8a74-08aa6ccda577", "sighting_of_ref": "indicator--b1746985-b1da-498d-8385-d0d9ca90070f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49795375-56e0-4b0d-b5a4-8d880a7b15b2", "sighting_of_ref": "indicator--3efad483-e421-433c-85ed-fa19493f4fe8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07fd48c6-19c7-4dd2-9a04-ac36291f33ee", "sighting_of_ref": "indicator--7c92dacc-89bc-4ef0-bf6b-85c73c17a051", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--750b3cc2-2a9b-4c02-8ed4-a0033716c40c", "sighting_of_ref": "indicator--84275bf1-8920-4a63-bb2c-2916b943628e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a1bbaed-5e76-4af1-b4f9-d3c3eeae6254", "sighting_of_ref": "indicator--b8ae891d-00ea-4c92-b8ef-e1b6c357082d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef8c4fc9-9208-4fc7-ab67-3d7125df4836", "sighting_of_ref": "indicator--0b8789e0-f716-4652-877f-80616ff0ba37", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80517591-7398-431e-a637-edb54c0c0f76", "sighting_of_ref": "indicator--d21e5cf0-76ef-4e1b-83d0-149b5acf1d35", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8b563e5-ff09-4dbb-be4c-31b5e6c52ac5", "sighting_of_ref": "indicator--5f0e9496-b29b-49f7-bf5b-b63e42167748", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f75f1ba-7082-491d-9133-82cb7dc6c115", "sighting_of_ref": "indicator--5f34d2f4-c228-49b3-bf58-64fc16822e38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2dd03f8-a12e-4dc4-95c2-80fa0e02320b", "sighting_of_ref": "indicator--a2d35fd5-d22d-4b96-96c6-88c6e60471a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f765758-a2fb-44d1-bddc-48f83e673c02", "sighting_of_ref": "indicator--4d2fe46d-4fbc-45dd-838d-5765c9f1f0e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c724ac8a-6be5-4511-a6a9-9714f404b570", "sighting_of_ref": "indicator--0a9b30d3-f889-41a6-a0f6-29083c9d26f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a0f66fb-02fe-47a5-922d-384fb4b7175c", "sighting_of_ref": "indicator--c287f22d-d52b-49ad-99a4-073ac4d799bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb85751-16d6-405d-9b5f-924e6c83777c", "sighting_of_ref": "indicator--540389cf-963b-4e01-ab02-b220e5b06550", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d07d0d44-4402-4935-bb10-ea1a120c14e3", "sighting_of_ref": "indicator--58b31b46-62f8-4fdc-9d22-a1350c754d29", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--603cc5c3-95ed-44db-a7f7-0e9e4c1788b3", "sighting_of_ref": "indicator--ca9b0290-6919-438b-a432-8241567af8e8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00be63b8-db4f-4883-ad82-9c3e0eea7a9e", "sighting_of_ref": "indicator--a756ffe9-a153-4b48-bc0a-ceb600d1458b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bbaf38d-c1c9-400a-88c5-dc89da3ff553", "sighting_of_ref": "indicator--0f2f4d66-568d-4dec-8282-527d396ac824", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f538bef-0364-4536-8981-c9f9070313e2", "sighting_of_ref": "indicator--dd2ceb2b-0822-481a-8d94-9bc4bb34d967", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffcd9862-4ff3-4964-9d1a-2747b6f254d1", "sighting_of_ref": "indicator--035af755-ae79-42a3-a00f-350d2234805f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31429c08-9998-4aea-bdf4-f6419e8b759f", "sighting_of_ref": "indicator--4f5f3b47-d1bf-4fa1-bbe3-da96e7a95bdd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a0da491-d90c-41bf-8850-798c0644cb76", "sighting_of_ref": "indicator--fe0b3c36-ff74-46fd-bdca-69bb0c488762", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e1fe065-1780-4e29-b9d6-c360b6352a7d", "sighting_of_ref": "indicator--0a7b4bac-e756-470f-99da-8f097d14280e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2e1bfc8-6510-4b12-896c-2ad353bd3e9c", "sighting_of_ref": "indicator--67a7e5cd-f415-4b89-85f4-14f1ac26e7a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05a985b7-ee57-47d9-9e78-fd2e54b13bee", "sighting_of_ref": "indicator--c6fbd801-d10e-424b-b7f7-6e3da5c73b3f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428c900c-3e59-4d80-ab6d-6f620d9a7dd3", "sighting_of_ref": "indicator--7c64ee05-83e3-4bc5-88f5-ae51f0815158", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60d49cb8-37e8-4778-88bc-4991625b0426", "sighting_of_ref": "indicator--249adfcd-6f26-4494-8f6e-208cd68631a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b749a902-ee37-4bb2-8b50-5742082b852f", "sighting_of_ref": "indicator--ccf10506-aa2b-4bc3-a920-6010c38bcd62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5b13ac4-48fd-43ae-ace6-e82cf8c2c738", "sighting_of_ref": "indicator--52c4d174-ec52-452c-b1ae-ec96f44eb9b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--853750d9-1688-45fd-a4f4-d4483b62832c", "sighting_of_ref": "indicator--2c55006d-6429-489f-845e-f12310f9a9b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d34e3a1-0a68-462a-aa8c-0ee1b8e6d00e", "sighting_of_ref": "indicator--527218b6-c00f-4486-aae1-6f40820cb1be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0c8a086-6428-45e9-8e05-ed4271e015bc", "sighting_of_ref": "indicator--258dcf78-24ff-41c5-be59-3d77e01795b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa0babd-1f80-4a33-bbb6-eb8060509c5c", "sighting_of_ref": "indicator--48a92d33-fd6d-4cc3-9a7d-a3aae0f483e5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f22c1d3-e3f7-4be7-b04a-e4bf42fc53e7", "sighting_of_ref": "indicator--fe4c6afd-dfb6-4329-9a05-9ff27d269626", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0a3fcdb-2407-4969-90ae-6de8f3ddba33", "sighting_of_ref": "indicator--aa3232b6-fa64-4623-be8c-fc2bf3d7ea0e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--583f8556-fe4b-422b-83e0-0c46072f0b9f", "sighting_of_ref": "indicator--276ae3f1-21a4-4344-bb99-028b24530339", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a174e513-45ff-43ba-9882-dd8110fb8390", "sighting_of_ref": "indicator--683e0a31-feaa-47ea-ad29-6e48426d05f6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd3eb113-c56d-4f81-8e83-aacd394502a0", "sighting_of_ref": "indicator--6010e60a-e3ae-4146-aa99-71590e8784a0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8263a7db-532f-4b85-be45-dc5938707848", "sighting_of_ref": "indicator--438f8c47-fb99-4a5e-9153-be5ef1113b2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01e9ee46-4827-4e2a-bfb8-9975063f6366", "sighting_of_ref": "indicator--831f7867-a3e3-458d-a2a1-982010580ad7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfa53ed-f493-49a6-b34f-d68c062ebdd1", "sighting_of_ref": "indicator--1114071a-0ff4-4cc8-a305-3da8ff269a44", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce9232e5-3f32-413a-8091-6060736ed59e", "sighting_of_ref": "indicator--201418ae-f162-4757-ab0b-99d359bd88bb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295add9e-80e9-47ff-b1a4-45222f92f9ec", "sighting_of_ref": "indicator--2cba3c83-abef-4725-a3bf-cdb5b9eb13e2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c21e8961-5a63-4794-85c8-7a492ae9fbf6", "sighting_of_ref": "indicator--4feec7f7-11bc-4348-ad84-03b91fbe170f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebfe01f9-bc52-4a2a-8664-fb035235260e", "sighting_of_ref": "indicator--914e5032-0ef8-41cc-941c-893e32d1dd4d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541cd1c0-3374-4df3-8289-d602b68c29b7", "sighting_of_ref": "indicator--bc91dc04-7a5c-431c-9e39-25f3df9c71a2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fead1ec2-e400-42da-80c2-daa8cb5cff0d", "sighting_of_ref": "indicator--597076fd-7b7d-479d-9592-fd8417bd968e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--635ef694-7e91-4b94-a527-cbf3ff024299", "sighting_of_ref": "indicator--e817c11d-dc28-46e0-8b72-9c16229548bf", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b71b0e1-dd70-4e6e-b608-aa7777de618c", "sighting_of_ref": "indicator--9c793265-2942-4c11-b8d5-866fc178083e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c4609f-e4e3-4ced-8ea7-25f55f275faf", "sighting_of_ref": "indicator--7580cb60-38c2-41af-84f8-a8d5c705d847", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d22f558-219c-4fe3-97d1-9bcbf5b7794f", "sighting_of_ref": "indicator--1eb6673a-156e-4ce3-8787-2dbf31ad9846", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbad6d1d-fe8d-4be9-b954-b4188891f64b", "sighting_of_ref": "indicator--223758be-93c7-4ff6-b033-7ded1d59d9d3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b109bf66-8913-40b4-b3bd-834fd6da3d5b", "sighting_of_ref": "indicator--84147bfd-dadf-4ea3-ba89-4d5d2d3ebffc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d67186-561b-4a2e-beed-4f7551aad6c9", "sighting_of_ref": "indicator--fbf8a615-159d-44eb-98c6-21e5d74aab06", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc76cc5-347d-4516-8f6e-4a96a3331a51", "sighting_of_ref": "indicator--351de933-d96f-4e18-92fa-53dbff6fa94f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6943ec2a-49ba-4fe5-85df-29e113644d7c", "sighting_of_ref": "indicator--af8f51b6-f224-40f5-ba8a-bbdffe0407bc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fe75c2a-141b-4e2f-883c-f06118d34806", "sighting_of_ref": "indicator--04373af8-7faf-46c5-a826-0f0548d2d500", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc2f338a-1837-405d-b851-c6a711b41939", "sighting_of_ref": "indicator--5a93778d-add2-41d1-913f-27d3bb9e37e1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe3fdb4-6625-40b5-adf6-d0b71e0df8d0", "sighting_of_ref": "indicator--b600d874-5cc6-4b48-9d99-b9b132742f5e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c955be1e-07b6-43d9-8625-59a17619efd8", "sighting_of_ref": "indicator--1668d74a-46c2-4352-9f8b-f2cbd96828ae", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01fd7842-c89c-4441-9ce5-d114ae1a69cc", "sighting_of_ref": "indicator--bf7f3744-f312-4099-a7f6-8769e1bf181a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b71d1b7-0514-44e6-bc78-dd46a006e1e9", "sighting_of_ref": "indicator--3d650657-a5d3-4378-8645-e4709f118de9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d37c69-3ff4-4f00-bef4-6df5a555e8cb", "sighting_of_ref": "indicator--04685df1-0df0-4d94-a7ab-4cc2337115eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4737e2d9-be72-48d5-8a8e-5a50999d6331", "sighting_of_ref": "indicator--ccb31349-5867-4fd7-85cb-734ce1a0c7df", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dc0a244-c2b3-4463-851e-89f8256eb035", "sighting_of_ref": "indicator--ee78c720-c869-4128-a611-bebcc6b563e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f8b7ffb-81d2-4333-9c31-2d705bc8e6e5", "sighting_of_ref": "indicator--5afd7da6-c410-446a-8eae-c1d0e4890cb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--529519b1-5679-4578-a038-0dca740aaa8f", "sighting_of_ref": "indicator--7fefa0ca-c8d7-485e-a5c3-3b1376acffd4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4581869d-f6bd-4845-a6c6-49988e1c16c0", "sighting_of_ref": "indicator--a7aa8251-5bb3-437d-8fbf-e03e89147937", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeb924d2-df95-411f-9554-7844e301dd2a", "sighting_of_ref": "indicator--6310f636-4027-485f-931b-3be663361184", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53913195-359b-4da0-89cd-adf2505f4e29", "sighting_of_ref": "indicator--d145a606-6cb8-40b9-8ed7-14009eceb0f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ded8a0-33a7-457e-a2ad-7aff0480dbca", "sighting_of_ref": "indicator--4daf6a7f-c95d-409b-8906-bedc7bba1c31", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b125c4bb-aedd-4d4b-9ab3-71c5ed8350e0", "sighting_of_ref": "indicator--42df4fb6-14a3-4a07-8a8e-d7140904ea44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a94eac9-c9fb-4740-95e6-fae2437197a4", "sighting_of_ref": "indicator--159e8456-2000-40f2-936b-75228b347ffd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd2d1afe-b38a-44c5-a872-c763f9748cb1", "sighting_of_ref": "indicator--c7be099f-ae42-49a1-87e6-93cbbbab3911", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b43d1185-c271-498d-9740-3dd40ee14335", "sighting_of_ref": "indicator--872651e4-2986-416a-ad9d-a63fb6f2c173", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59011843-a514-4c96-a1e1-3bdb473095f4", "sighting_of_ref": "indicator--e94ed29f-6eeb-4fe3-9d0e-f9412e135676", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f5fbe4-889c-455e-aa64-dd88dff231f7", "sighting_of_ref": "indicator--1742640a-7205-44eb-a08f-dacb599a8948", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--893f7417-fee2-4b57-9e11-17de757d3c20", "sighting_of_ref": "indicator--89940136-e85a-4d1a-a1da-cf969dfa0eb1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a803c180-6975-4758-818f-ff4d999a2424", "sighting_of_ref": "indicator--2bafc678-eb69-48d0-b98f-ffde3226ff4b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26747666-9b52-4dd4-bc16-e374bf2f77e1", "sighting_of_ref": "indicator--1cda2e48-deff-4987-b2a4-51aaa14a49c5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa29189f-5043-49c2-b7d5-a41ef18470ee", "sighting_of_ref": "indicator--3caa1dae-1a7a-4953-8798-63e6568f860e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db5a5d17-cfc9-4234-920c-ad874d3a766a", "sighting_of_ref": "indicator--3caa1dae-1a7a-4953-8798-63e6568f860e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6a4a3e0-4209-425e-9d01-b6bbf94d4cf2", "sighting_of_ref": "indicator--69f43ad1-da6e-4fe6-9097-ea5e32989603", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b5a2259-23b8-4d7e-b84a-a676e4efa49f", "sighting_of_ref": "indicator--71d965bf-a0b5-4d2c-92f7-161a49cc3100", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d131f4-1530-4f0b-9aee-504d472dbe1b", "sighting_of_ref": "indicator--18d71dd9-0fd1-43f0-8ab3-4eef4bde1822", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ed2e8d-fd26-4763-a6d9-532d83a51243", "sighting_of_ref": "indicator--35b70df8-0f73-423a-99d3-8b6683964f01", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abd97cf-ce80-4362-90c8-9c7d0ff7a889", "sighting_of_ref": "indicator--de2680d6-81f4-4b8f-a231-cc03bf4605ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9adbaf20-947f-4903-9cfe-9bb7bdcda2ac", "sighting_of_ref": "indicator--779f0ee6-5813-431e-bc9a-26bdb1842ed1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3510806c-a73a-49a6-91a0-86ecbda77ff0", "sighting_of_ref": "indicator--aa93d960-ac4a-409a-9c14-7d0e062327cc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f4688b-6c68-41e9-aa50-3134237f11df", "sighting_of_ref": "indicator--2b8ad393-9fb9-473a-8529-fdb2c9d37bed", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--398c962c-9b89-4798-af77-c21645647c2d", "sighting_of_ref": "indicator--6c43ad79-3bf8-400e-982a-f902b2b2ee61", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--220891f1-6875-4d7b-8010-b36f986d806b", "sighting_of_ref": "indicator--a27c14d0-62a9-4a27-a4a9-a4fc593da091", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f495cd-6d9f-4c52-827d-73094a235ae9", "sighting_of_ref": "indicator--64363c0f-d1d5-4cde-b9da-03c5dfd09abb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88ff2a12-c687-4e94-8048-af5a92f3eacf", "sighting_of_ref": "indicator--788afec9-f171-47e7-9457-925f6ea78254", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--494c68a4-02ae-4bb4-950a-167ec408a52d", "sighting_of_ref": "indicator--8df5c7bd-4638-44c6-8c0e-c4c6e1f3a5ca", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb9954ba-8d2a-4344-ac98-2bbaa6e7815b", "sighting_of_ref": "indicator--3f38faff-d990-4126-83e7-abc8eb6579fd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69217dbf-b7f4-4fd6-8ffe-4246742c6880", "sighting_of_ref": "indicator--25881b1b-4158-40a1-80b8-07a880a84afc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4b589f-80ff-4fbd-af36-f4ded992c12a", "sighting_of_ref": "indicator--238fa334-743b-4ce3-a6c1-2634d53b322d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11f30f9e-e0d9-484a-99b2-15df82c07cf8", "sighting_of_ref": "indicator--5f4f4b03-0e4c-445c-a2bc-a44169b81776", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e4d114f-0204-4d39-837c-c1ce1685a00d", "sighting_of_ref": "indicator--51757df8-96f4-4ae7-9731-e4b682459491", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06a93697-018f-45c9-ad1e-29db3b9a5165", "sighting_of_ref": "indicator--3e2d100f-255d-406d-8bfe-6795648d7532", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a93ec779-cbeb-4d17-a2cd-1a47d781bbe4", "sighting_of_ref": "indicator--efa89ba8-651d-4f1c-ba42-d0f59420627b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2287a382-8ce2-4f7f-982c-e1eb1854fd48", "sighting_of_ref": "indicator--9a736195-aee1-4306-992c-25e140f14d32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1979702a-2b79-4c43-a8a7-9351794f3a8b", "sighting_of_ref": "indicator--d9535587-1ce6-4fff-aa38-a64446a48603", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d78cd4b-ae24-4b1e-9142-5f6905dfd3e0", "sighting_of_ref": "indicator--5110064b-1bab-4a85-a0f7-7ca18bb8dc69", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb63f8ae-f50e-435a-aa7f-b56b5d70653e", "sighting_of_ref": "indicator--c707ad15-7e76-4e0e-9169-fd6bcdf85d7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdbfa9e0-a661-49c2-9631-fb4bfcac0182", "sighting_of_ref": "indicator--efd6550e-6fca-4171-a57d-b241cdd31e0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05a6ab8-f667-4c6b-a756-1bad69a64fb2", "sighting_of_ref": "indicator--d13955a6-0499-42e5-bbd3-7a86578c46bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e18fc6-e27a-49f9-acd3-305b0daaba57", "sighting_of_ref": "indicator--8c8a730d-61af-4f07-ab8e-9bf609cafe47", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f36b8217-a348-456a-8d3b-53d0b6dedd14", "sighting_of_ref": "indicator--d148ab19-7911-4446-9cdf-225675f37b53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8711e0aa-b059-4244-beac-b503bc5af9e1", "sighting_of_ref": "indicator--00e5af9c-ce42-4255-a7ff-78c671fcde3b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91dd01a9-68e4-4d79-b14c-98961559311b", "sighting_of_ref": "indicator--8ce92044-c1ad-4795-9255-2cc0a5bd8539", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6effbf-72fa-417c-8852-022e04e5f28c", "sighting_of_ref": "indicator--3429288e-a554-4d95-94d8-ad302afb68cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5902b2f0-1754-4a80-a922-e3a8a667c2bd", "sighting_of_ref": "indicator--5107137e-0e41-436f-af60-43e1263cba52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4c408b-442a-466d-bc08-7b8850516379", "sighting_of_ref": "indicator--1172b593-2048-4382-9b54-707831a8a75c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72c0af61-05e1-42f3-abe9-bb27409292b1", "sighting_of_ref": "indicator--3402cb3e-5dd5-4459-8f64-6e431b8a395f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5763df9f-d72a-43f4-99d9-449fa5fd862e", "sighting_of_ref": "indicator--3ae95d57-6ed3-40b8-be91-5a0746143c1d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44674bde-83e7-4f17-b46c-facd5c0e3216", "sighting_of_ref": "indicator--ff5e6a7e-e9dc-496a-b15d-85f219047829", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--804972cb-bc8c-4f6e-92bb-36f9c2fba361", "sighting_of_ref": "indicator--3b40a5bd-ff9d-48cb-ad07-d0ad5550331c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efa6faec-ba03-417a-9916-2ff865f84af9", "sighting_of_ref": "indicator--152e5580-b9c1-46b2-bae8-771fc234e193", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--104f1afc-f9d7-4125-b521-6a92007eb0d0", "sighting_of_ref": "indicator--16fb481d-2d22-4f69-aa5f-da2667831d3c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df083b18-f982-435d-97e6-ce40f729ebc4", "sighting_of_ref": "indicator--1d36f9ec-5ac7-4ef5-95e5-5af81421e70c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de2f654-ae6a-4167-85c6-997438220bea", "sighting_of_ref": "indicator--ed2baf29-01c0-4430-b8f3-1c68b531fda8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48bca54a-ba49-4ff7-95aa-cf3afd4f4c5f", "sighting_of_ref": "indicator--5945e718-7ca6-4318-8d7d-a5039af3934f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7a9518-7a53-4455-b557-0495fd3945aa", "sighting_of_ref": "indicator--20c62f5f-4a2d-4b80-9d9c-9a06908cfb2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f62b9d-1491-4542-9973-7062127d3b3f", "sighting_of_ref": "indicator--3bc2d8a6-376b-4595-acf5-561d06859ee1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751d2ff1-d882-48a3-bc55-c17dfd566d5b", "sighting_of_ref": "indicator--1de80741-289b-4f53-8191-c7fdb8bf29c0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798c25b5-7300-4742-8d43-a6b9317bedd9", "sighting_of_ref": "indicator--6f64481c-c0af-4f75-bcff-f1c86d45861e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8699e1e4-2d55-4cdf-a09b-ffc84d285577", "sighting_of_ref": "indicator--812adbe3-a6f5-4d05-a30a-1a01b599b931", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3c63788-294f-4c5a-9d2f-f4f73969d076", "sighting_of_ref": "indicator--d10b1c06-9437-47e1-b002-6602347508b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa996f38-9e1b-4006-8f45-9e7b02568e43", "sighting_of_ref": "indicator--f3fd8d5c-640b-4f48-b1f6-64a1716234b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--135d49bc-f076-4c57-9614-4cb86b847881", "sighting_of_ref": "indicator--01a57948-7f57-4fa1-90b3-2c0e656cba2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af7c525-fe63-4348-8aa3-b2ae02efcee9", "sighting_of_ref": "indicator--9ae44610-44b0-4667-9ae5-2733a8072e27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6aa6b8d-3f86-4d77-828d-8a863b5d502c", "sighting_of_ref": "indicator--d6047014-9978-4b92-a4a7-506d87691ef9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9def5795-fd83-4152-b5f4-1224d4ffd5c7", "sighting_of_ref": "indicator--1d812548-f3a2-4518-acf2-1ec7ba6a9542", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ced3e548-1669-4ce4-909e-b4ada73bd557", "sighting_of_ref": "indicator--c7c6cbdf-eabc-40b4-aa5e-ff705133a6a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a71f753-fd05-4743-8ccb-24026e153028", "sighting_of_ref": "indicator--34151ebb-77c1-44b9-afdb-0253838d88bf", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5582e2a-ce73-4e3e-8dca-b8c87b9803de", "sighting_of_ref": "indicator--43fb9aa7-0051-4224-a252-171300480fe5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2146cb98-4ef6-471f-b83f-8a609a9899b5", "sighting_of_ref": "indicator--1faad29c-4a96-43e4-a6b9-aa41bddca3f8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a63f42-9ee6-4b1d-a54b-846e9cad7468", "sighting_of_ref": "indicator--5d7d0959-07fa-46df-8ad1-c54b9d37a43f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--211bdd81-fe1d-405f-ab05-4d756d7e93c7", "sighting_of_ref": "indicator--fd115209-a6e2-43d1-81f2-6b32a2ea068d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc17a36e-fe77-49b5-962a-0a57271183f2", "sighting_of_ref": "indicator--f291f7fe-10f2-41c7-af16-15b39a42dd73", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35aff7a7-a62a-4e21-a511-8e0883d590c3", "sighting_of_ref": "indicator--b6ca5588-131c-4811-b89c-f1524a3d5843", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4ef56b-6408-4bbb-80ea-2078f5cd90e4", "sighting_of_ref": "indicator--615c9c31-9365-4fa7-b952-e7ed996f9558", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd4ea3fd-9e9d-472e-a4a0-a5208822adf8", "sighting_of_ref": "indicator--2635a4a7-b7bf-40ec-979f-7a527e5dc61f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b6a1c98-17ac-4ade-a600-1d51a4be1428", "sighting_of_ref": "indicator--8f7fb108-5ebc-444e-a150-907664da6724", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--387a1384-ca9a-49f2-8bca-dd7bee9c3556", "sighting_of_ref": "indicator--c573e781-e7cf-4944-b52a-28e6be347fa0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a04d45-4b0b-4b9b-83d8-bee97d404733", "sighting_of_ref": "indicator--5b11c3db-96dc-404f-99bb-48d55ce232c5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877a591b-bc4e-49ed-8d34-f2ab092005c9", "sighting_of_ref": "indicator--4adc8126-4f19-498b-a775-1adc6ec0b6c3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0518955-33fd-448b-a97e-a37490e206ed", "sighting_of_ref": "indicator--357f880a-b25b-477e-a417-7d280d6fc43e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--056a4d72-89be-4cf7-b246-94666a4c81d5", "sighting_of_ref": "indicator--b669d077-e7fd-4943-999b-e0c11ffe888f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cacf1a-efbe-40fc-b44e-9c0d604846d8", "sighting_of_ref": "indicator--a9e7e028-3732-42a3-abbb-17e65c42a646", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--471ebfbd-da25-44f9-8db0-fbf623901212", "sighting_of_ref": "indicator--a3f21f27-7fe9-4ea9-b74d-d3b7831007c6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf13998-2bb9-45d5-950e-7c12d92f38a9", "sighting_of_ref": "indicator--abe208ee-f620-4251-8ba5-a8438b6e04d2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4299b67-08db-4368-9858-3eeb324bdf66", "sighting_of_ref": "indicator--3f91ed30-0f0e-453b-88ac-2bd91887b2c8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc72bfa-27f4-4dc8-a3b2-60d8bac3e586", "sighting_of_ref": "indicator--f452fba9-89d1-4307-b0ec-a59f2395539a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ae87ae-d5be-41f0-9a56-113de7cb540f", "sighting_of_ref": "indicator--c97ff426-7cde-4cbe-8b97-4ee3dbf1f9a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d04af2-5d1a-433b-8fc3-c88bca51c29d", "sighting_of_ref": "indicator--8bb81007-83f5-48a0-b43e-52848c996f22", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d245e8-4ca0-4f9e-9f55-a7bdd115786f", "sighting_of_ref": "indicator--53d2bdd5-1b70-4a21-8239-e5ee4d7562bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cecb5ffd-0abc-4437-8845-7567305b8adb", "sighting_of_ref": "indicator--cd0bbd51-1655-4d3b-9a4f-f93cc3ad562e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3318805b-0a5b-4e76-8e6a-1d53211f7cd3", "sighting_of_ref": "indicator--e36cf727-abc6-45cb-9207-973db4ba7601", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4f148f3-3094-4e27-b571-6279def7476b", "sighting_of_ref": "indicator--d6dae9f5-ac59-4875-bdfc-29b4d773645e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8ae7f3-8419-4a79-adf7-16f4e6585a6d", "sighting_of_ref": "indicator--897384c1-88ef-4469-abc6-1e9b7c9354f1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e084d6-b065-40c4-a2a0-fa4d3dc88be0", "sighting_of_ref": "indicator--ac6a1361-9147-4d8b-bcb2-ca6e55dc4f4b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fafc6960-69f8-4a9d-a30a-db81f821d3e7", "sighting_of_ref": "indicator--16c801aa-dba4-46f4-8215-0da6d1bb4e38", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b5cfe1-7455-4074-a0fb-ad2f5357a403", "sighting_of_ref": "indicator--af6ce598-bd24-4b4f-b282-b8d32fb4af4a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--669ffaad-ecd4-46bb-aff6-53c3cd2af369", "sighting_of_ref": "indicator--e9d95150-fe5f-4f47-a8ec-dba79f0d7ec8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61add8b4-72c0-4030-9858-c9ec246d0451", "sighting_of_ref": "indicator--fa95b6e3-6aa9-49e6-b96d-b8446733630a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63bdb8dd-d9f2-4041-9974-618ad88d7c6f", "sighting_of_ref": "indicator--94b14061-864a-4740-a51c-43f8875a293a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60105a65-f841-474c-a5a6-8b7e2f353deb", "sighting_of_ref": "indicator--58fcc7cf-f372-45c8-8896-36a1d1715039", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa70908-4b76-4f5d-8122-7ce18aa8f1e9", "sighting_of_ref": "indicator--cd980e59-a7f3-40d5-a759-dc1d777119be", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72ab1ba-38e9-43b0-807a-dcd4764ab805", "sighting_of_ref": "indicator--f95e5fab-107f-4fa8-bb17-53cfef4b2d69", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6f14618-5410-4221-a860-e297a0228248", "sighting_of_ref": "indicator--e936bf66-20b7-4559-aa84-20a7daa45cea", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59d9666-f785-49e4-9332-b863a973a4e7", "sighting_of_ref": "indicator--253f31df-82ec-4b3b-915f-7d56c9a92a63", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f2aa0e9-803a-4d05-ad43-feb8f7f6e93f", "sighting_of_ref": "indicator--677378ec-6166-4a46-beee-a9a5a6d747f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a01d408-38c8-4149-a403-9423253ed6de", "sighting_of_ref": "indicator--b80217f5-27ca-4a3d-9ae6-fba37df584db", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef56869e-06d6-4532-84a2-04273a5a2c90", "sighting_of_ref": "indicator--a6ada5e0-96f6-4564-b0e8-1ff47ec07d1c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d17afb81-4a38-4aa9-8f58-577b40534c47", "sighting_of_ref": "indicator--cce48714-c89d-44c3-8d87-8ba4c4721dd4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14da7ebd-f061-4437-b128-827d492eb408", "sighting_of_ref": "indicator--8ea09ac6-1422-4c88-8e3f-99721e16dc85", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--026f1165-599d-4adc-879c-d4c4da5a1b53", "sighting_of_ref": "indicator--6e206a16-1722-454d-90a1-d12fd05eee2d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f6349ae-34ad-4d85-9a57-1ddb00bb05b2", "sighting_of_ref": "indicator--571ab340-fcf0-445f-8901-2e451dd76866", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bd238f1-e4df-4bf4-b681-937fda9e0444", "sighting_of_ref": "indicator--03776a10-0995-4459-840b-86d1d9c2d3b4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a767aa-cc3e-45a5-8025-7630aa0f7076", "sighting_of_ref": "indicator--d2c2aa12-fcc8-4566-b827-cde02b6b68af", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20cb628-ba3c-47ed-a97d-35268d87af1d", "sighting_of_ref": "indicator--6e09b94e-96a9-49ab-9e5d-3cc4bef16369", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b767e8-4626-432f-985f-60dac0fda9e2", "sighting_of_ref": "indicator--bd708cf0-1ead-4956-a215-82bf4d413e92", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8d3f39e-e71c-40f7-ace9-ed9e3ea7c758", "sighting_of_ref": "indicator--0262051c-5f2e-4566-bbb6-7ec8bb679972", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e36b06f-ec9b-44aa-832a-4407f5ea396c", "sighting_of_ref": "indicator--ca5e9899-96b0-41f4-b5a0-70f46b9e096d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca9b8d6e-2947-4f9c-a357-94f219b77b32", "sighting_of_ref": "indicator--a69294be-0f9d-42b9-802d-0a6f876ed299", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42a6a3dc-b84a-4297-8155-178fa7128f8d", "sighting_of_ref": "indicator--190d2729-e161-4307-b9dc-79f9d31a25e4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--085de3d5-85a5-4750-83f7-8014463e5c9b", "sighting_of_ref": "indicator--166631d3-bc4c-483c-9a82-4547001a9a4c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0655606c-b401-4fa7-a8a5-1a20beb7d480", "sighting_of_ref": "indicator--9f740bec-a3b9-4b39-871c-aaf641348a8d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a4ded2-4cbd-4615-877f-29b3e9cabeab", "sighting_of_ref": "indicator--f49d8959-ef50-4e56-8f94-05a60cdd9c3f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0a3141-74e2-453d-a1a7-4f3abb82691f", "sighting_of_ref": "indicator--9895cff7-b0e9-4dda-aa7c-88692a805440", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--160d77de-a8b1-4a2d-8c24-7104a321a64a", "sighting_of_ref": "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--353b3c18-f395-408b-b5db-6e84a9fac9e9", "sighting_of_ref": "indicator--f0ed03e7-5916-47b6-bd68-c68a479c1f07", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf69fb3-bfc3-4ec6-acc2-2ab0fb85df05", "sighting_of_ref": "indicator--ada3ec24-1327-424b-a798-85db53014354", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d0914c-cf84-4a41-a640-e242f78016e5", "sighting_of_ref": "indicator--79ae51fb-76ee-487f-94ab-683c75d341ba", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2c22a61-ecd6-4cd1-b22d-f49a302f49bc", "sighting_of_ref": "indicator--8535bf61-f99b-4d8d-b360-c9318506aa0e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb9bf0a-0e11-4673-89f7-7a18392b1636", "sighting_of_ref": "indicator--970e5424-ccf4-4703-a4b3-82d23cfc049f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65df9b54-98c8-4820-96fd-05d3d402d2d2", "sighting_of_ref": "indicator--342b5b36-40a7-4619-9cc7-75275daa5629", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f09112-0894-4f54-9f20-c75d06a581cf", "sighting_of_ref": "indicator--a0a36b34-86ac-4816-9888-695feb868231", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e81515b-7fc6-44f2-8e66-40380cb4f609", "sighting_of_ref": "indicator--14ecb896-57ef-4e39-be1f-29ceed2d5a69", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5983d2-b467-4ab8-8df1-645baf866691", "sighting_of_ref": "indicator--394da047-edd9-4f83-a7f1-2698f5621878", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bb5c47f-6898-4024-a23d-6cffe5fa2d42", "sighting_of_ref": "indicator--1c4231f2-df58-4752-b3e0-9b24a2ecbbba", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9735cef4-d079-4513-9ff9-9ed48876018e", "sighting_of_ref": "indicator--4db1ffc2-c3d4-4a1c-8aca-f5b5302142e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a4c6af2-4b83-438b-90f8-8283d98b235c", "sighting_of_ref": "indicator--3b8ccd31-cef0-42f7-93f9-6d9455fa552d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92e80640-ad16-4a6e-9a2e-dcabf122208c", "sighting_of_ref": "indicator--6a2f6fda-871e-4c2e-ac06-7d10a7045102", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc5ff13-0483-4e52-b847-f396ae7c9eba", "sighting_of_ref": "indicator--8c3c1182-70fd-461b-88a2-26f83bc89015", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8fd1c91-04e1-4aed-bc0e-8aca8b0e98d6", "sighting_of_ref": "indicator--8167b699-bb6b-4f98-8448-be8a0bb66b4a", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d54a2172-03c2-4304-8c2d-84eda75e2d3e", "sighting_of_ref": "indicator--83ae313c-1347-423d-a33c-0fc3b52d1b8e", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f81a19b5-8304-4965-b798-ac8f2e9d6f83", "sighting_of_ref": "indicator--0a54de28-f086-427d-bbf8-4f09566ad59d", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bdce214-e4de-4f5f-9ef8-c08f2959497f", "sighting_of_ref": "indicator--df14ec23-5cd9-4075-9c61-3fa5fb031da5", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb745e1c-3503-431b-9482-491b7c414e72", "sighting_of_ref": "indicator--724fb977-76e2-48ae-8d38-1c66910da790", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468f6e05-e45e-452d-ae8f-90b015e22b6a", "sighting_of_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52d6a434-c243-4ab4-ab27-1b7dcfe27ca8", "sighting_of_ref": "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ab32ede-b746-4ff2-9bd6-b2205d8a015d", "sighting_of_ref": "indicator--78eb99d3-479b-420c-a437-a94fd9541877", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40ecdfa6-bf08-4e41-96cb-23371b1bbc66", "sighting_of_ref": "indicator--ea39fd80-d94c-4db4-a66e-46e3a8d0c183", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--695a9ef7-6450-496a-8c75-bc36c43de1d4", "sighting_of_ref": "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38396349-ab09-4814-9541-5a00ec1ddd9e", "sighting_of_ref": "indicator--cd9a0195-7300-4bfa-9cf3-d1c3f5dc5cb2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a11d0051-2ec6-415e-a5e9-f4425e66d531", "sighting_of_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f0686c-84fa-40c8-9657-339add51a70d", "sighting_of_ref": "indicator--e222893d-16c0-4415-959c-57149f5e8222", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bc3cf21-e6e2-4d98-8421-e2a1fb34ac83", "sighting_of_ref": "indicator--cd0e3ff3-68f5-44d9-822c-a1ec44b61e72", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c02aded9-4e10-4e75-a343-0fa457d60688", "sighting_of_ref": "indicator--64991e9f-a450-4ed8-98d8-1d139a0a470a", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cdf834d-576d-45ea-ab46-18e2925d6070", "sighting_of_ref": "indicator--246cb5d3-9114-4c11-b7a5-0a24df039af1", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1233f151-98bd-4077-ab53-182783df0222", "sighting_of_ref": "indicator--4a906e25-3667-401d-9549-547e782b2e43", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--857dff9c-dc43-4368-ba9f-7a2579f2e501", "sighting_of_ref": "indicator--759a1240-9a9f-48ee-8c4d-309e945ea6a3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60bb30da-048f-4101-be94-1cd3ea26a3d8", "sighting_of_ref": "indicator--e4519d69-6f74-4ffa-8b74-23ef9a41e21a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ea9fd5-2e22-4834-9646-34ebe39e388e", "sighting_of_ref": "indicator--3fe7de4b-3914-471a-8051-dbc558203f6a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0423fd9-26b6-4534-90ab-cd451158194d", "sighting_of_ref": "indicator--29cda941-e907-4562-92d7-48b70fb674f1", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--561448cf-a36c-4c5c-96a5-41031ffe6d20", "sighting_of_ref": "indicator--3501d0a8-e652-4957-8c89-36b68c3d9136", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22745de5-f3a4-4269-99f3-06f34af148b3", "sighting_of_ref": "indicator--2bd3e8ce-d087-486d-ae56-ae387f593931", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6b6787f-53de-46ab-afc3-d35f03010c95", "sighting_of_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9ef6a67-e7c9-442c-9479-29f36eb43b14", "sighting_of_ref": "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7984a525-ebed-4f5e-938d-be5ba93c01ce", "sighting_of_ref": "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7406670-f430-4d72-b5cf-ab2fabc4045b", "sighting_of_ref": "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3a6f6d7-110b-4dff-8b40-7c9e42dc6830", "sighting_of_ref": "indicator--98662a19-dd99-4d15-bb34-969ecd8a5d53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90cd5902-981e-4142-8586-717ead5b7170", "sighting_of_ref": "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecbad441-e16a-4429-a62a-4d8342d7864f", "sighting_of_ref": "indicator--26786ed1-8a09-4dd5-a2b7-3cff98280e30", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bff936-564e-4408-81a9-a2f882bd34a6", "sighting_of_ref": "indicator--27a535ef-62d2-4353-ae32-a28c1da1594f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c713bf32-2983-47f6-85a1-f30c1e8bc5ed", "sighting_of_ref": "indicator--0da64d65-1329-4402-86d8-daba417204d0", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d153ed4-f247-48d7-86a6-e6a11d2e83c3", "sighting_of_ref": "indicator--7cd3cf7c-569b-41bd-90fd-ef576b05077d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfb27592-d51a-44b7-8887-3cd3546cda83", "sighting_of_ref": "indicator--e54034ac-6119-4891-ae7e-b466265e56bd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--931d863f-d37f-47bd-8473-24e197ff0c91", "sighting_of_ref": "indicator--52a7ab71-9826-4cdd-b1cc-a421db6b0079", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42400e2f-f153-4bf2-bf18-1dc8c27c554b", "sighting_of_ref": "indicator--a96cb52c-a9ac-4023-92a7-69316b00874f", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b0bcf43-639f-4958-8031-271641fa6384", "sighting_of_ref": "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0fb93ff-8b76-4aa4-987f-a7bfcc366bba", "sighting_of_ref": "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81a9d28-7add-430e-aa9f-8e6dc873e268", "sighting_of_ref": "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48547dd9-7d23-4d9e-9d16-065da559854a", "sighting_of_ref": "indicator--09952396-fe23-47eb-a743-c257776cb68f", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66895ea4-f9e8-4c17-ba79-804e8d8d6e13", "sighting_of_ref": "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e64b579-6879-4981-9ed6-a220eb0b8a85", "sighting_of_ref": "indicator--f7ea7d7c-fe40-42d4-bf34-2bd04f542244", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b43dc49-38fb-48c4-82c1-fa27f265e6cf", "sighting_of_ref": "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e71956c2-971c-4900-9069-ff0248e43438", "sighting_of_ref": "indicator--a4ac20de-8612-4a8a-bc3a-a786dc127e1e", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--262abc07-e6b3-424c-a771-a056a932adeb", "sighting_of_ref": "indicator--19a57c48-2d64-4e93-b7f1-60b11d7599e9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2565862-5034-45db-83b1-ddda029c72bc", "sighting_of_ref": "indicator--a8b43332-f635-432b-ad1e-5432fe763ac7", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f8a6db3-57f2-45cd-8df0-076a8051cb11", "sighting_of_ref": "indicator--2a7ca733-698c-4784-981d-9e64f9691e98", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a769523-0c9b-4e97-9af8-2362c9f8f5d7", "sighting_of_ref": "indicator--a6fb4ec9-c401-49d0-8018-4fa2d3a1ef7e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ac1ff2a-929e-481e-9bdc-0845b9a8eb01", "sighting_of_ref": "indicator--86bb8ead-8f81-49ba-949e-14cb424fb483", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dca6783-3f87-4487-88ac-994aedd79633", "sighting_of_ref": "indicator--2c0a6334-af76-420b-8ae9-a47146ea86eb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3053bd5b-ff57-4d4d-9bf0-cdde2613ae2c", "sighting_of_ref": "indicator--c8fb2fe2-5d29-483b-a618-69dcbd588e73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d29033-b7d5-4166-be24-363cc129f5b2", "sighting_of_ref": "indicator--3df1eab7-a2cb-4df2-9eed-5d7c1d94ef53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c808611-fa09-43ff-b5ea-39a7552aab8b", "sighting_of_ref": "indicator--b8a57676-1cd4-46ff-891e-6d75c5cd38e4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8943c8cf-c02b-4fef-a27a-b8f1b9ec2f10", "sighting_of_ref": "indicator--88b9684f-7ce4-40b6-8cdf-8f421bb2180b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9415a70-e81f-4811-8c02-57ac7cfa295e", "sighting_of_ref": "indicator--0b0650a4-53c2-48f3-8cba-414cf5f4b6f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed62af46-70ff-4c09-8566-b25177ade166", "sighting_of_ref": "indicator--38c5c399-1452-4c53-b886-64fee9172c7a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b6145f1-dcd7-45c8-833d-ff6d0de3d44f", "sighting_of_ref": "indicator--04f1669a-cedb-4afe-b1a5-b44cb4a3d8e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3b1df6-45f7-4147-80a2-e7dfa8df0ac1", "sighting_of_ref": "indicator--e3b7b595-7038-4ea7-9c25-1c943b8d58d0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3bec00a-1b90-408d-8a4f-784401fb9f9c", "sighting_of_ref": "indicator--15393fc3-731c-4a7c-b397-0d5e63620d86", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--221f807a-9964-4e64-a299-1bba56100aaa", "sighting_of_ref": "indicator--5486f46d-9d07-4b51-ab4f-41fb45742cf8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7c7953e-b07a-494f-a776-2de41df47898", "sighting_of_ref": "indicator--562a81d6-7673-48e2-b122-5de7e29ba8fb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75ab02b5-06e6-49b1-b637-e749b853b4c1", "sighting_of_ref": "indicator--2afacc4f-25ec-43dc-86e3-0c2a59991611", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a157f589-cd9c-4b1b-8cb8-a5acee6cb027", "sighting_of_ref": "indicator--ae6aff00-8ac6-4a66-a72d-592ae9ebdc1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--044dd25b-fd1c-49b2-82d0-2fc76610ec17", "sighting_of_ref": "indicator--7aec10dd-e9d3-46f4-bc1b-2a4b661a121f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75352fb7-bcf0-4b0e-bb09-a3c0c34e94b6", "sighting_of_ref": "indicator--1640d3a1-35a0-4084-96f0-d3b351f09c82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86a9e85e-6fa2-4773-b064-de5f3e21fa84", "sighting_of_ref": "indicator--ccfa4205-89cd-4224-975d-6f266fa452ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60708b1c-e7e8-442e-af56-bcf234c3ed52", "sighting_of_ref": "indicator--cc2b832f-aed9-4bfb-a4c2-f6f729a7fba7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57412f3a-7ea6-4c74-8858-1af46926b013", "sighting_of_ref": "indicator--b21897d4-e300-4942-99ee-134c0ba2305c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8147f0b-302a-4962-9904-37519a114730", "sighting_of_ref": "indicator--7a4771d0-519f-4650-bff4-09e37e82bd7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e6307e5-0176-4ac7-83ff-9d7fe509c4d2", "sighting_of_ref": "indicator--1a6834f4-eae7-4900-bcb3-2638bdb6a1ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50a85533-cd43-4bac-97f9-df05520f7d5b", "sighting_of_ref": "indicator--e68e59fa-a02e-438a-9402-8f1a602a572a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de61979-c044-4866-b150-994dd5d5d84f", "sighting_of_ref": "indicator--097791db-3cac-46ab-94b1-f8350f9d6b7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d985d2-ddb2-48d3-a6ea-ebba8a33e438", "sighting_of_ref": "indicator--0b25bf8e-7b64-4e84-9d66-b6f97ab2ef09", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edd430b0-986f-4d3d-bd90-0aafa41aa16c", "sighting_of_ref": "indicator--eeae4180-9160-47ca-ac82-7fe15dac0614", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9548a2f-f0d5-462b-859e-1223cf0dc2be", "sighting_of_ref": "indicator--5958a761-a22d-4da1-bd80-d4403cbd8a15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e080edc-9789-43c7-ab03-3ec48697faee", "sighting_of_ref": "indicator--8ca93bc4-5a41-45be-8fc2-1003b8922c34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d1dd53-8277-4a91-b8ef-27a21aec7466", "sighting_of_ref": "indicator--67661070-7006-45df-bd84-260cb7e05f90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27a0bcf6-574d-49f7-9975-e9e4dee032d5", "sighting_of_ref": "indicator--ac1d495b-c14a-4f97-a971-8be770a52a87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a39419f-7f24-4870-a39d-c296c0bcb48b", "sighting_of_ref": "indicator--c9bd0ecf-9171-425e-afe2-b9a2cc041c39", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55bf9a07-2ba9-48ea-93f4-69b517343d78", "sighting_of_ref": "indicator--9d3243f6-c1d6-4ec0-a7ce-f36666e4a69b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bfc84a2-4894-42c7-ad3b-997edf98c212", "sighting_of_ref": "indicator--d5ea3724-09e4-4ef5-8b7f-9e66754076a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--186d1767-01a3-4df4-be94-e208ed4c044e", "sighting_of_ref": "indicator--44621493-b8dc-462a-8f4e-89f1869ef30c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39635c9b-0576-408c-ab9a-ba513f06c162", "sighting_of_ref": "indicator--81a22ed6-2876-49cc-9b5f-53b2d7184427", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41648b46-ffe9-42a7-94e9-613daf4e9efe", "sighting_of_ref": "indicator--36391f3e-9610-4cf5-82a4-6442b9edf09c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94070729-460e-4c23-8e03-1d6448a1625c", "sighting_of_ref": "indicator--8c78ba85-ec48-446e-ad71-e2f44395ce54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53cf2845-c2ce-46a3-9353-dbf4492b2e4d", "sighting_of_ref": "indicator--23164220-cecd-40c1-ad75-a87838e98270", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bafd0aca-a4b9-42c8-8bf8-6eea3fb6f6ed", "sighting_of_ref": "indicator--2ab1a440-de62-4933-8422-55ade0218147", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8abc4f7-27c3-43e7-9064-271b0bc688d0", "sighting_of_ref": "indicator--e4bbaf4d-d282-4831-9067-397fea4f8af5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b8253b9-d7ae-478b-ba79-7f4d960593fd", "sighting_of_ref": "indicator--e78453f6-874a-4b28-b7a3-a0f849cb5d64", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ed1a0ce-1c19-4d45-bcae-fd4d54923795", "sighting_of_ref": "indicator--f1a85567-5d36-4c53-9c84-3324f97a3ff0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a000630-f46f-4641-9f3a-e9da78108663", "sighting_of_ref": "indicator--0e772c69-0a4b-4a66-a881-7595d824f5f0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--912576e5-d18c-4aac-899e-3fd041d6ad23", "sighting_of_ref": "indicator--5c0efa6e-4f70-420d-aa97-e0175199e4d2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b0ee51-9e4c-4505-a4f8-63f80eef6698", "sighting_of_ref": "indicator--ec5bd722-76be-435d-96d1-5832476814e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c919dad8-e869-4f87-a056-3f3c7dc2671f", "sighting_of_ref": "indicator--4ddf2e1d-6ad0-498c-a4c2-1aa2c398ab10", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3847ef09-b66a-4651-bdd0-e24d384fb15c", "sighting_of_ref": "indicator--a703065d-3ad4-4778-b274-2cf57a81cd2b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--205a6496-4e5e-4404-b08d-11fe231370e9", "sighting_of_ref": "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15721b27-5397-4d78-9137-eb9ee8b96122", "sighting_of_ref": "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d36fe905-70ac-47f4-b976-023a53acf6fb", "sighting_of_ref": "indicator--b501c71d-54ff-4db3-b4e2-271128831635", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c69b6483-975c-4089-bfd6-69ac24fbb862", "sighting_of_ref": "indicator--4834bd65-8b43-4237-9ba3-80666a987dca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf1e5373-ba42-43d3-a4f9-b57bebe7fdb2", "sighting_of_ref": "indicator--e19de7d7-776c-4fc2-a503-00bfe0124914", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8297a0ef-251c-4a39-92fa-28b16534c727", "sighting_of_ref": "indicator--def3432f-5aba-4586-8c1b-91057ba0439d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a4f41ec-8729-4a0e-bad9-fceb1a128926", "sighting_of_ref": "indicator--db152f04-abed-4341-bb9c-4bc20e8b1a82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9983d2-d140-4f55-85fc-47bbf7baf6e0", "sighting_of_ref": "indicator--f5f9bce2-3aab-4ee7-a373-ab2e0788f329", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e0d258-d91e-484b-adff-5541a44bdc84", "sighting_of_ref": "indicator--8354f740-6ffc-4a10-9398-f16db67f7f30", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f1cc3e-9b26-4a79-925a-7a03cc3128af", "sighting_of_ref": "indicator--7e099565-8b3e-4a60-8373-78e29f6e1ff6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e48e8d28-f748-4c24-831e-60a8069977b4", "sighting_of_ref": "indicator--f95b3855-d991-4601-be5a-04444bea8b71", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1a61648-f986-4826-92db-fe140a8e6e53", "sighting_of_ref": "indicator--5373b6aa-72a8-4e8f-8f70-d51a90ac25d2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4691aec3-bd53-41d8-b5c3-60b28291dd46", "sighting_of_ref": "indicator--46088861-21c2-45ad-8ca1-f49f24027d99", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fae8c8a7-f1d5-41b2-8b89-e9de6ef28bb1", "sighting_of_ref": "indicator--fa5d92e9-5ac9-4524-82c7-4d38b6603af4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb1d3130-e517-4888-93ac-98890b3acbfa", "sighting_of_ref": "indicator--0cfe2acf-5494-47f6-9eca-bdd7e4d1f4d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a93fbdb9-a6b5-4043-937a-17c63ed69dd3", "sighting_of_ref": "indicator--74ee07d7-7756-498a-a850-0da6f41ab439", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b1b467-0c19-4efd-b3ef-087085b2c652", "sighting_of_ref": "indicator--f2e48272-61e8-4ec6-8177-f07186b283b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7067569-0c43-41d7-9e85-ec87064c3e0f", "sighting_of_ref": "indicator--4ec0254b-4462-4aa7-b6d7-c6950a6d7b96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4aa229c-84ba-45bb-8677-9ef385a1966b", "sighting_of_ref": "indicator--30de864d-c4b3-4c51-847a-347bfbd5e7a9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b5157b-d782-40e5-bada-c47086df6330", "sighting_of_ref": "indicator--afe81ed4-13f5-4586-a745-791249059e9c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9a2f972-f53f-4f57-a784-a56bb93f4b88", "sighting_of_ref": "indicator--96e8e721-ce07-41df-a720-5885a921f145", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c3cc67a-d69d-413c-b6be-37df5e839cc8", "sighting_of_ref": "indicator--35ffef25-97cb-4f97-9f14-b3bd2306e4c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ac6668-19da-4a68-9500-cf8a14406ee6", "sighting_of_ref": "indicator--34ecf09b-4c11-4d0c-9d6d-5656c3d8c82c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c9c7685-978c-40e7-bed2-dd51d33307c5", "sighting_of_ref": "indicator--1d1192f9-24ca-4290-8e2e-d27022cb85a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2d7d665-886c-4b42-b1db-2cd38507d6ec", "sighting_of_ref": "indicator--4217202a-d9bf-46ce-9ab8-b1b05abc96e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c8f3b29-bb4e-4596-8391-d47920652e9e", "sighting_of_ref": "indicator--3d602c3e-2947-4a81-abb5-3c0e457df5ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d235f3f1-1f38-4dce-8a38-74ca58d44260", "sighting_of_ref": "indicator--40c37842-7f55-40bb-982c-df4462dcfc50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe30732-5f27-4ee1-8712-b6d965febf4c", "sighting_of_ref": "indicator--97fe5cf0-443e-48ca-9176-89d3073b8e3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26bd3255-99e5-49f7-9565-e40f9934bc24", "sighting_of_ref": "indicator--87c2d3bc-0526-462c-9991-88e9c76c9e88", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1922a40-93e6-4bf3-8216-f932c411f1c6", "sighting_of_ref": "indicator--4d6cf95a-1805-444e-aace-958254a83cbb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b52d9988-b0ec-480f-b4ef-e3a2550628c9", "sighting_of_ref": "indicator--9d574693-84a6-4265-a2af-c88196cee675", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e8d6a07-df09-480d-9870-1bb3057b66cd", "sighting_of_ref": "indicator--905bb737-395a-4bfa-a192-d4247d807b25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71d6bf97-7432-463b-a58d-04d9d2530e37", "sighting_of_ref": "indicator--46ceef33-74e1-47a3-be65-867e19b09764", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c11edf8-e49b-45af-b5d6-34b1da44514d", "sighting_of_ref": "indicator--7c2d9676-9969-429e-9c91-eaf5c2123fda", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baac78ee-9624-4dc8-b212-6e3d276a109e", "sighting_of_ref": "indicator--61d9d3cd-9eb0-43c8-9c21-37b7eb89cfd2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ef7e8b-e0d4-4d0a-8d40-236a4d7b571e", "sighting_of_ref": "indicator--4425f531-ff6b-41b8-bea9-250a404fe7dc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ec5764-06a9-4376-b124-1eaf01fd0bf8", "sighting_of_ref": "indicator--717ff8f5-138b-4581-aca8-a53507ba9f8d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef44337-af95-4780-a96b-4b78e413479b", "sighting_of_ref": "indicator--ac875c58-4cc6-4b3d-9457-5287fc820ac0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0a98950-4c6f-4a6e-bafc-61edc1228d49", "sighting_of_ref": "indicator--02c2c5b2-5d2e-4c21-b79c-42bac60a1de0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9717b7e9-c479-4bed-9381-f744a5182ce9", "sighting_of_ref": "indicator--4feda227-63f4-42cb-bc86-091a1e3f6d13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ba6de28-d47c-4dd4-9002-15340ce4acc9", "sighting_of_ref": "indicator--2dfd8279-f030-4888-af0a-d0ede843b7b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d5d6505-b2d5-40b8-bdb9-1bb03619b7f4", "sighting_of_ref": "indicator--b70eb3f4-67cb-4881-a880-bc49bf9955d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f194d982-47fa-41c1-9e2e-0dee93ec3a7c", "sighting_of_ref": "indicator--0186039b-4d8c-441d-aef0-e935d83d061a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--130cf209-5c2f-4d51-a176-c2c3381a90d5", "sighting_of_ref": "indicator--089a93eb-7ebe-4120-b2de-cfd77b03b345", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3692d5a2-8885-46f2-9d29-f147a0d405b7", "sighting_of_ref": "indicator--265a4e64-e6d0-4d50-a42f-02eb1ad5fb1f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f9fc01-3ff1-4879-93b0-a120814bebfe", "sighting_of_ref": "indicator--c489bfec-b949-48e9-b60f-58fc7aa1e71d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61358201-4deb-42eb-bebf-ac5f68946e8b", "sighting_of_ref": "indicator--950f571c-3f69-4ef5-90f7-64d0a75603e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e8b7543-759a-4f4d-b36f-45feec2c7f68", "sighting_of_ref": "indicator--4499cc03-4d9f-407c-b0f8-d8250162cd4c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ada7bb8f-7a39-48f7-9953-31b20f0ab142", "sighting_of_ref": "indicator--0c061c50-06b9-491c-8964-7ddc7f3035da", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2048dadb-ced0-4c8a-99f1-47e9d13011fb", "sighting_of_ref": "indicator--52ca2bb8-3dbd-4a8f-9903-035c41529996", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32bbd938-079e-4cc6-9796-5a1713bca75c", "sighting_of_ref": "indicator--0eed15f7-74b1-47ac-bf62-d5c985cee7bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7c0ac1-3dc0-4d0c-874f-e1d7f17a37aa", "sighting_of_ref": "indicator--ac4fe748-03b7-4997-8037-7a0922c4daa3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a54a97d5-3e2b-45f5-836e-c4ace3550fdf", "sighting_of_ref": "indicator--b5ee3209-ffe2-4980-9c58-09a36fb246e5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--662a9033-b9d7-48fa-a97d-23051e0f8d02", "sighting_of_ref": "indicator--dae80c12-9002-413f-9b3b-de9b7301f358", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f18697a3-4ae4-4615-8bfa-9a47d2103f2b", "sighting_of_ref": "indicator--99cdde50-6f21-4043-a6cf-025dc217dbb3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--497bc8c5-aa2f-405d-b72f-1271f50105ea", "sighting_of_ref": "indicator--783b7eb3-dc4c-4a86-bd41-2fb828ea2120", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e2a55c-76f1-4523-bd44-9a0e528365ed", "sighting_of_ref": "indicator--30e5fe3f-5263-455d-887c-43f03f7a36dd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba53277-1a60-4bee-a53d-9eb39d5ca0c0", "sighting_of_ref": "indicator--b1213282-4682-447e-ab28-69a9621dcde0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a1081f6-edb4-43f3-9714-e79fb792e464", "sighting_of_ref": "indicator--062dcc06-09e8-4e9b-8ce3-2ed1369c8a6a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b847a32-e89d-4653-8cd7-fffa75614cc2", "sighting_of_ref": "indicator--830e8ec2-34fe-476b-a392-05057628e8d6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7792b2-723a-450e-8c0c-a94eaa9a250f", "sighting_of_ref": "indicator--2e2bf181-cc6e-43f9-a711-c00b3bbf4322", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fd63e8-89b7-4c47-a4cd-f11a55524ff6", "sighting_of_ref": "indicator--b743f314-bb3e-441c-8170-fe9883ef30c8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2c12d0-6419-488c-a5bb-1cd257f08139", "sighting_of_ref": "indicator--64d198e5-a02c-4158-8715-4cad43a3595c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--510c9a43-821b-4186-9e09-334928a07b67", "sighting_of_ref": "indicator--c97a0c3b-56e1-4c09-8b8a-036cc153588e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c69ed906-f62b-44c0-ad08-45c1ef434a2c", "sighting_of_ref": "indicator--0e71bf9c-7970-42d6-b6b4-a75f25246427", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76ecf917-da9e-46e8-826c-842da63da32a", "sighting_of_ref": "indicator--9758529d-bda6-47d8-9e93-5f3125265761", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f66809a-6d8a-4059-9d97-8a79ca55b24f", "sighting_of_ref": "indicator--2b9ba97c-1259-453c-9903-053d8debde6c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db5fcf06-a015-4cb6-b2d9-b0571566d2f4", "sighting_of_ref": "indicator--732005cf-380f-4737-8c83-57410e010aa5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edbabb1c-0d16-4d6e-b0be-6681118f9beb", "sighting_of_ref": "indicator--487b2515-339d-4892-a46c-afe265b8f9dc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf4c0940-fdc0-4907-bc1c-7fb46e2e003a", "sighting_of_ref": "indicator--32f0469b-1d8b-403b-bf8e-7129a3305e57", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da3924a-74c4-43a3-9a26-c61eecf0428e", "sighting_of_ref": "indicator--d8d04443-e2a2-4499-b159-b4cf0c39c896", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2f3a57-afc5-4ec1-9cc6-621b70d43c81", "sighting_of_ref": "indicator--d5bb48df-aea2-4a17-be82-6e29f89a8f9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0f767c1-58ad-4853-83e3-0cdf3a10e1be", "sighting_of_ref": "indicator--44766863-c330-4f33-b9a8-3281c1fed27b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fd3164f-7f92-4f31-9e1d-e0f700468595", "sighting_of_ref": "indicator--68a099f7-2ae7-4141-a44a-e088021e2479", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--424e4d3c-1467-45e2-aefa-a2271b71b11f", "sighting_of_ref": "indicator--a82e5ba3-2ce1-4ef9-b001-2fb5b298a7cb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72d9e9e6-d973-4249-b0e7-c846b5b903d9", "sighting_of_ref": "indicator--225d9218-d4c5-4f5c-9307-4c6d7f9a06c1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1efa1d5d-4c33-4ec9-a0dd-c99402001e0c", "sighting_of_ref": "indicator--0f0e54d4-4624-40fd-99d0-a7933c6dc8e8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfaaec8c-834f-4651-b10a-75fec0104728", "sighting_of_ref": "indicator--13fadb42-ff78-4fcc-9bc9-fbd759d25950", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2780281-1486-41ad-8295-40063d72b8a1", "sighting_of_ref": "indicator--8ac46dec-1efc-4314-a6bd-e54ffd61b7a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b02c94-f91a-4917-8716-bbeddc49a577", "sighting_of_ref": "indicator--06db1016-2ba7-4f4e-ad0c-094983febb7c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5d5bcf-8b86-4972-b4b9-e41ed1e19f1f", "sighting_of_ref": "indicator--f3f96baa-dc2d-40a4-b929-ab84ed52689b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14bfb5e5-0ccd-4222-8021-503bdd90cb60", "sighting_of_ref": "indicator--bfa1a702-301d-4a8f-ad00-f76ced7f7be9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c68226b4-4d53-4005-b153-a3801430aa58", "sighting_of_ref": "indicator--1798cd3c-8b23-4c2c-8ad7-6749a4c3b067", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a7351e3-3120-452e-9ab2-9890c982fcc0", "sighting_of_ref": "indicator--3a18b4f6-465c-4ad2-85cc-93f65623a91c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84d9ff97-9fd0-4526-ba40-415fc72d4493", "sighting_of_ref": "indicator--35ecff25-8425-45d3-9882-d86836ae3a64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cef90b05-5553-4482-8bb3-a8b76d0b3bf5", "sighting_of_ref": "indicator--fa80a60c-3fb8-4eff-85c5-008f63845277", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c17e6c8-c4f9-4207-9806-c91bf248cb5b", "sighting_of_ref": "indicator--6da31b62-03b9-4f98-8a12-83695f823be5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12474b8b-1c46-4d46-ab3e-9eb6d2f548c2", "sighting_of_ref": "indicator--20851a2c-3bc1-4b65-beac-15c595c27d59", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2917793a-9980-467c-be87-aa5d3854ef0a", "sighting_of_ref": "indicator--51c6c0f8-4637-4e0d-98fd-4ed698db19c2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cc4996-fef1-4da2-9fab-e6831672e0ec", "sighting_of_ref": "indicator--77ed316a-203a-42f7-97b8-c874958e151f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ea37b57-4d09-44f8-b885-e63dc5ff5ab8", "sighting_of_ref": "indicator--a5be6849-619d-483d-8a4c-495d2d080c6f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb7a344-b4b7-4fd1-910b-d193901cfc06", "sighting_of_ref": "indicator--8fbf6ec4-21c4-4317-b8d3-14ea6c3c85be", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dafe581-a00c-446b-90e3-3c3facde787f", "sighting_of_ref": "indicator--e66f17c8-72e3-45bc-8805-d08ec74283fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b395c37c-57c3-42c0-933e-21ba2ff0c9a3", "sighting_of_ref": "indicator--ee351ca7-8613-4a06-9906-1904d8b85398", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b4355c9-0b6c-4064-9ba7-9e7525fa7099", "sighting_of_ref": "indicator--b534dae4-6175-43a1-9397-7f6561c11877", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8650224-d2b0-43f1-8d6f-e5152eff2e4e", "sighting_of_ref": "indicator--0601d210-d5bd-4688-be6c-4e3b9150646e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8785fc86-717d-4d28-a9d9-4529062f7387", "sighting_of_ref": "indicator--a27ab0f4-0c12-49bd-9d4a-fbbf89235b4c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--521ec225-d2fb-44d9-bffc-9cea9a01bef5", "sighting_of_ref": "indicator--4cb068ed-1173-44ff-8705-58cea4ed8568", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--727c1a01-fc27-4147-bed7-6a9a04dcf6b4", "sighting_of_ref": "indicator--f96a7052-082e-4944-b4b9-88434f2edc86", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54058320-b151-4a31-857e-0f07db940ab0", "sighting_of_ref": "indicator--e984f3f6-2fb5-4523-97b9-e27d45a18398", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7afb3ed-d73e-4098-bc44-ea085638b14b", "sighting_of_ref": "indicator--52e5636a-3573-4123-aa4e-fb1c9c648696", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--037436c5-4ac6-416e-8f78-f7aeb9676fc8", "sighting_of_ref": "indicator--36d0fe63-d244-432b-99fc-05d96a8fffd8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ee9744-9ec7-4bdd-8097-54ff9cf078ec", "sighting_of_ref": "indicator--a03fb8a5-47af-4cbe-b1b4-a3b92bc4520e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e40b857-d761-4d6c-a5cf-e0eff9978bee", "sighting_of_ref": "indicator--61da5585-c400-401c-b59b-f9e3b037ac57", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ef5bdd3-7bbc-4670-83b5-b7599dec0d39", "sighting_of_ref": "indicator--18c5b578-7ac1-4e08-8de1-7414104d86ff", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af5e4dca-6652-40ae-9d97-b2f1e8329718", "sighting_of_ref": "indicator--ab586679-ac8d-4e44-b3b3-7f2df7b23651", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fd03e37-3719-4d51-8d8b-79b6d02d86da", "sighting_of_ref": "indicator--3e623e69-60a2-4656-a670-05a6770ab1fc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--648db06b-bea5-4623-9ea6-7f48bfcf823b", "sighting_of_ref": "indicator--747ecce4-6ac7-4bde-9abd-f12ece2e0ab5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293ec34a-7cd2-4693-b8f3-eebf97c57cfe", "sighting_of_ref": "indicator--6ded691d-6f75-474f-8f6b-9998bce60f94", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5bf4496-128d-4588-89aa-cc06ded5596f", "sighting_of_ref": "indicator--61a7865b-e0dd-4564-a1d5-26a6d86f2f5f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--721b7ed8-8867-42fa-be83-803a7f84928f", "sighting_of_ref": "indicator--832521c4-c4db-4579-be20-d4fec49630cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6f91c27-ad6f-415b-bbb1-8169026e2fa2", "sighting_of_ref": "indicator--83ad81ac-82a3-49d5-b8dc-0de04412ad03", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4c4b087-2934-4bb7-973a-0cf53a41fee4", "sighting_of_ref": "indicator--9d712f43-fab8-4536-be2f-207546690680", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b99adb-ef51-4245-a3f5-5382f9329327", "sighting_of_ref": "indicator--d0a3ba45-47de-48af-be7a-8766449ced0d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29d7fe05-fde9-4c64-ae70-ad2325cf52a8", "sighting_of_ref": "indicator--49f25bef-a50c-4b83-a3d4-dff50d51bd95", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4948312c-2926-4fe7-a845-860de3cc4229", "sighting_of_ref": "indicator--d770c335-ee98-4a3a-a910-0942fc6960a0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24878f86-0e9a-412b-bb0d-eef4dbe84456", "sighting_of_ref": "indicator--8d56ca6e-313a-454a-a656-908ff5dfb06a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda1875e-b47f-42c4-a8dc-e734608b1c83", "sighting_of_ref": "indicator--c6231e71-3849-475a-b4e1-ff0bce5345d5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c65a9da4-4ff1-45f9-a3c0-b2d007da64cd", "sighting_of_ref": "indicator--db7ed5e1-3e73-4077-8263-f1b1b7960f7a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe6c7aa-7c62-41ff-af91-8cdd8ba79ed6", "sighting_of_ref": "indicator--21924000-e2ab-4c27-90c2-221ff8b636ec", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73bd467c-4f66-4c34-8e43-e990dc9d116c", "sighting_of_ref": "indicator--a7219b81-35a5-4b25-ac6c-f5eef52741f0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91775f09-24b4-4bd6-8519-a8fc2cbb507c", "sighting_of_ref": "indicator--354dae42-e2aa-4bdc-84db-d42fae223a81", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c0464b0-44c5-4e92-9c59-78fb6be2891e", "sighting_of_ref": "indicator--88df1f4d-813a-42d5-9ac2-132a06efd000", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa3cd5e4-d8ec-4027-92ee-29f19e15725c", "sighting_of_ref": "indicator--b166b69a-e141-4d31-b37e-e5f991b14a75", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c929bfd-c5a1-45d7-96e0-e56aff2e702d", "sighting_of_ref": "indicator--e7a34a23-5129-45ac-b797-d38f012146ee", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61974df-ee91-4135-b7de-da7d7d33bb10", "sighting_of_ref": "indicator--0640eaa8-9b02-44f0-95d5-d9b922131422", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5294acb-85e3-4604-b763-7fd31210d03d", "sighting_of_ref": "indicator--9169b4b6-513a-4131-a563-4dc8d2d6728d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8c10173-3e42-4097-855e-69fcd7ee5a71", "sighting_of_ref": "indicator--5846adf4-de4d-4549-97ba-cb7f8ee0ecec", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bfef809-103b-4408-8d53-13b9f2df2e95", "sighting_of_ref": "indicator--6ec20d59-73b6-4226-b7ea-f1d3190d2a69", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a739c8c-d792-49a5-a145-538463488807", "sighting_of_ref": "indicator--a27cb341-5dd3-4218-a156-5820fee92534", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2b18287-c6f6-45ff-aed8-f4de6c9d6198", "sighting_of_ref": "indicator--9939bfa2-f42a-4457-8c32-18c6f4faad67", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2120b2-c7e1-4cd8-8ced-09dfa17ee04e", "sighting_of_ref": "indicator--0955a836-4f42-44fa-8c8e-9f018dec7290", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e48bbb2-49b4-4e7b-bb6f-a03e21f33fdf", "sighting_of_ref": "indicator--716b82c9-fcb2-4d98-b9c5-4412e2daf38f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966bb47e-2003-4e32-a812-0bc411fd1622", "sighting_of_ref": "indicator--8b2bff80-6172-4465-9521-bc1295786907", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22a63ba1-9769-464e-be8c-496f98529338", "sighting_of_ref": "indicator--cd9ef2db-abe2-41ce-bf52-9413a89429b5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be73d89-3c8b-4ef7-9dc0-a929d1a18deb", "sighting_of_ref": "indicator--73473477-c01f-45e6-8ef0-c2a3e5b0a1e3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d6aeb50-f8b7-432f-9aff-c0be07e30929", "sighting_of_ref": "indicator--32ee435a-d3a2-4242-98a2-e8388c0fd0ef", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f725dec-df4e-4f9e-945f-beac8eb05eed", "sighting_of_ref": "indicator--68ae37f3-a9ad-4c44-8a5c-05d204f92111", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7856db18-2414-43c5-9989-15da1e52e2b8", "sighting_of_ref": "indicator--60f6532a-d796-48d3-a2ed-ee8725d666eb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbac1286-1d71-411b-a4e6-47b30e95a76b", "sighting_of_ref": "indicator--2da1c6e9-7cf5-4b60-9835-2d474b4d1289", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baf04ffe-e8e6-4af7-b543-2b4249bf38c5", "sighting_of_ref": "indicator--d604ea2e-9c81-42e7-852c-095892682fcb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ce8627a-0881-4f08-9130-cf336144323a", "sighting_of_ref": "indicator--c07d9cbd-c5f3-4e30-90a6-1cea8de1adef", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c0e3add-bc1a-41fa-8588-2aaa14949e58", "sighting_of_ref": "indicator--16178bb0-34d9-4daf-8671-02766129fee8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e392f94-e72f-419d-bcae-768d1d7bba0f", "sighting_of_ref": "indicator--971264fb-326d-4425-aac4-bc6b35edf437", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54366a66-c1f2-49c9-a834-349b738f2815", "sighting_of_ref": "indicator--f0fa2a2b-fdfa-45d7-a7fe-0d602c8e5e65", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4110e8-4e2a-4884-ae41-04d4cb267201", "sighting_of_ref": "indicator--7fe701b6-a9bc-4b45-adac-ddd109d9ad21", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75cf0ff-a12e-41bf-b6bb-f4562ac70694", "sighting_of_ref": "indicator--2c0ae264-9278-43a7-ba07-3db4829876c6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c07054ea-e660-4070-901e-2a7d5b5469ae", "sighting_of_ref": "indicator--fd7d91b5-236a-4d43-af07-a4d9e5bee945", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e23d76-8d85-4e01-b7fb-3f29cbed2391", "sighting_of_ref": "indicator--a63cb6ad-23d0-4207-a492-68966306ec85", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e41d04f-6f36-4d8f-9ebd-acc9b57c9837", "sighting_of_ref": "indicator--313ee934-2561-418d-9606-62d3c3a75046", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f49d27cb-5b16-4170-bda9-49ca8e8a400d", "sighting_of_ref": "indicator--837b2ac0-dc9e-4c05-aaf3-4f93d44eb700", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--087d5ad8-b5e3-4ff7-82c2-480e2fa4a82d", "sighting_of_ref": "indicator--c269f442-6d14-4cfa-a7e7-34dbf59a7691", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87e5d03d-2818-4f8d-83a6-2a5901a9c834", "sighting_of_ref": "indicator--ab895138-0ec5-4af8-9367-0df42a745836", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa590a3-f9fd-4b5e-8060-438516af031b", "sighting_of_ref": "indicator--e84ebf5e-cc2c-4b9e-810e-96c5a385afde", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c931c5-23aa-4fab-973d-1f28fd2d900f", "sighting_of_ref": "indicator--ec93cbd2-cbee-4661-80ca-adbf46b3063d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c170d86-4354-4c88-8aff-6653e2fb4aa4", "sighting_of_ref": "indicator--b4837696-8ac5-4159-9a37-3e76bdff17a4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13222f8f-12e8-40f7-8c28-975324b8a6a9", "sighting_of_ref": "indicator--6734a680-ab70-43c9-a6d9-d701de5f1c3f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10377a38-bf80-46f8-b023-dc97b3266acf", "sighting_of_ref": "indicator--c744fd9f-8d4a-4c9c-b8e0-6658b1b76d81", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa81a688-94f6-41d7-a4a7-38ad13a89cf0", "sighting_of_ref": "indicator--eadf7b43-0afd-4be8-a66d-a4996813ecdb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a41c5a36-f0d5-4e0e-b4d5-4819b8a65d6d", "sighting_of_ref": "indicator--c7691fea-4d16-46df-a529-817f3a907532", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8be464be-ab8f-4618-9167-746ac1a9b411", "sighting_of_ref": "indicator--b5df9c13-0ee9-4dfe-9ac9-fb6f5013595e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35da4f5f-9910-448c-8a59-4f54d707873e", "sighting_of_ref": "indicator--d2ae81ab-0dee-4ad3-bdb1-c19c3ed4700f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cced7172-bf00-4107-9d70-43cf8d5f8df2", "sighting_of_ref": "indicator--e9f1e85e-4513-4df3-bf5e-cc89b6d24120", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e08273a-157b-4c00-910d-d7eb04f6013a", "sighting_of_ref": "indicator--3a2becc6-a9eb-43c8-ac31-a9e62095bfa2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27939a47-0c2c-440f-a87b-91c374570850", "sighting_of_ref": "indicator--f41cf0d0-5893-42b5-8ae1-cb7a606088c6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97d27e10-00be-4c8a-8186-a8180d8eea11", "sighting_of_ref": "indicator--d553a5d3-e382-49c9-a736-7d5bb7296d17", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516a26d0-2699-4fd3-9e3e-c7eb3b0e377d", "sighting_of_ref": "indicator--82e1e4bc-5b39-4ea0-b077-525978dc51b1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b4b3a18-cbf7-4716-9a14-9e40ebb856d7", "sighting_of_ref": "indicator--21e04da8-2624-4edf-9ef5-3d9f35235de3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df23b9ea-aadc-4c5b-9a55-5f9c22912655", "sighting_of_ref": "indicator--2a805de7-dfd1-40e8-b10d-93d510a82088", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--793377cd-fe77-4173-ab95-5cf3bb1ed0d4", "sighting_of_ref": "indicator--3da1b2e5-fe63-49e3-b34f-3df3a657ccd2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa7bba3-e176-49b5-b0a7-8a943020c8a2", "sighting_of_ref": "indicator--151ac0e1-671c-44bb-975d-25d62b446bd9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c20659c0-3c01-49d2-bb5a-5f6cebd78b93", "sighting_of_ref": "indicator--64ff00f4-fb1f-488f-9cf4-65fc245d69a2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c0ca1b-715e-4b3d-95f6-d6f14ca31259", "sighting_of_ref": "indicator--bdb0fd34-e0a4-48b5-97ef-b245b516da95", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13e3afe7-e976-4555-bffa-a34c63d8d762", "sighting_of_ref": "indicator--75164a2a-0e8a-44b2-a63a-66fc1118d9f9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aacfc7c6-4303-43f8-9441-8b088ed28c17", "sighting_of_ref": "indicator--3fec2bd0-63d2-409f-9053-c40242ffb3d5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f760137-d67c-4394-8c43-71b39bcc963c", "sighting_of_ref": "indicator--fb363c01-db29-40f3-9e9c-c0eab16dc116", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0db389e4-0796-478f-a0eb-2c5dd4c02116", "sighting_of_ref": "indicator--2fed7340-c630-4ae2-833e-67f36f454879", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94035473-dfed-4569-a2f6-96065d3ee130", "sighting_of_ref": "indicator--a00b7a33-7686-45ef-a095-03fab410d033", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ab7e00-8c2d-4ecc-ad3d-0e2670ff5b91", "sighting_of_ref": "indicator--42b929d8-c8b8-49b4-9a52-fcc5786d91eb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32f0fe6-cf2d-489c-ab82-59792e27aa49", "sighting_of_ref": "indicator--5e198c08-70bc-43ab-b937-0d12f3972595", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dca0814e-b64d-47b2-be7b-9faadb88fcfc", "sighting_of_ref": "indicator--4a6e8380-6312-4d56-b5d2-6b068bbbe1e2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d139dd2-e084-42d0-9952-e15923cb0ac0", "sighting_of_ref": "indicator--af4b7001-8943-4607-a679-4ed4fefb0a19", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1371726a-251f-4bec-8af0-309c32c7b710", "sighting_of_ref": "indicator--af08f576-a9f5-49c6-860c-832c9c1aa8d0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053b0fac-fece-4f26-84ff-46856ec73f00", "sighting_of_ref": "indicator--2a389967-69f3-4873-9723-ba6cf8000f18", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201c9f0e-355d-4c68-94fb-5a6502d0325e", "sighting_of_ref": "indicator--5f908b8b-f0ce-4142-93d0-dd3a3e5dfc82", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e2d71c9-0266-4339-9182-3430465fee56", "sighting_of_ref": "indicator--ef8e506c-43f5-4918-a70e-062a7ce60b60", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d246bbc8-3c7a-4ac8-913c-8f74a57207bf", "sighting_of_ref": "indicator--dafb9c3e-2063-454b-a6df-408633bf0089", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d6e799d-7b75-477c-9161-0d9ca949a303", "sighting_of_ref": "indicator--7baabb12-6d22-43f8-a086-8782031f1159", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da5723db-1dbb-41fc-a680-439e7129dd0d", "sighting_of_ref": "indicator--8626e9f4-91e9-440d-a30d-10ae763018b9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6bfabbe-98c6-4338-a014-52c26cde325d", "sighting_of_ref": "indicator--cd6ca815-37ac-4b1c-bbe0-1bb2851fdf13", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38ae9897-2288-4c10-9023-b00a3656021c", "sighting_of_ref": "indicator--52d318bc-2d54-4dd1-aa44-e7a92713674a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09edc7d0-b857-4758-ba82-067d6f5c822c", "sighting_of_ref": "indicator--ff5aedf0-b0ab-4629-a0e9-38503994dd35", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--393361de-d390-47e7-a795-cf3413bc308f", "sighting_of_ref": "indicator--b64d562c-2146-45fe-ace0-3ca09aeb64b9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcad726b-1f84-4fd8-a99a-a961ccd3ec3e", "sighting_of_ref": "indicator--ae3b8db5-881e-4a77-9869-a21137bda1c6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3647545-f1e0-4d63-9095-f2c2b8b9f740", "sighting_of_ref": "indicator--d5a82f56-6b94-46ac-aa5e-d45d6418fd0e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab9ce4d6-4c57-4f3f-9c6e-00e702288591", "sighting_of_ref": "indicator--0b09b65f-dd09-4e0c-a2d3-2879d60f1f3b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cbd6e3d-9886-400b-9835-556870d57ff7", "sighting_of_ref": "indicator--9401cab4-a35f-450d-81eb-0cfe5516855f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb0b35f2-2904-4232-92c4-3c02b40f24e6", "sighting_of_ref": "indicator--d63c147b-96d7-4def-a3e5-47c95192d761", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf546fd-cfaa-4335-8f4b-8a0cf853be78", "sighting_of_ref": "indicator--daa1e77d-2388-49c9-a437-d0819d6dad95", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410412cd-1903-4f4a-baaa-9acbe8d1b037", "sighting_of_ref": "indicator--09db0f4b-6d40-4f72-97eb-87b3c0dd1ab9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dec5008-9380-40e3-ae68-9687973bb8c7", "sighting_of_ref": "indicator--c885a890-4261-4544-bd6c-5d7914452934", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b883ed94-d731-4f33-b2a0-c7d27e5630fd", "sighting_of_ref": "indicator--ba32b411-3dea-43d6-aed6-abefe4e74aa3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c7d615-5f85-4109-8dc2-6486364efb74", "sighting_of_ref": "indicator--ad6b4adf-f727-43ef-b389-08e061f261ea", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cc76dd2-a94e-46fc-b66b-11b11ec49535", "sighting_of_ref": "indicator--db8a0827-c3ca-4137-be4f-711d02421294", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f828058-1413-4c0b-93d6-7ac7fa9491cd", "sighting_of_ref": "indicator--c02da756-f264-4ef6-aa10-cf99e9f74af1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--112e0016-1c28-465b-a9bc-2a78c5e76a98", "sighting_of_ref": "indicator--95a368d5-9b22-4dae-93c4-c3499ece4bc5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf01f04b-047e-483e-a056-86a42782447a", "sighting_of_ref": "indicator--fd698f40-b5f2-4f0b-93e9-2416175b8269", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e8d2b4-8324-4b42-8d2b-b5c866271d58", "sighting_of_ref": "indicator--45cb37e0-097f-40b1-a472-53a9c60eb0a5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b7e48d-7215-4001-9c01-fc49517a574b", "sighting_of_ref": "indicator--e930d3e0-fee3-4bb2-914d-e8e329b0ed90", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d32c8f22-3613-4d35-8e50-28a1304753d6", "sighting_of_ref": "indicator--b4efd149-372f-402d-80b4-0c9b01dda5cd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4608397-227b-44c3-8be4-7d9518e844e5", "sighting_of_ref": "indicator--75fde9f9-b9ad-4ce0-8dce-b0d24ee9acc4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5017d4-cb72-40e1-a90c-2b53de369656", "sighting_of_ref": "indicator--cb2212e5-1dbc-4c8c-9c6d-5b524fc423f4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c4615e0-0b7e-43ba-9a4a-30e5b263514d", "sighting_of_ref": "indicator--fdadb15e-a093-4196-824f-fd619e2643e6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b36f839e-d44a-4638-b1ce-95b48da4146a", "sighting_of_ref": "indicator--25509ee8-fe30-45cf-8d4a-8cf7cc9c21cb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15eb78a-8d11-417e-bcd8-cd783ccf2464", "sighting_of_ref": "indicator--98ce05b2-4fbe-4b06-be7a-dae0c789fe20", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41071fd3-6e02-4452-804a-8cbb1fc7f7e4", "sighting_of_ref": "indicator--804eca06-ee46-4900-8e61-0cf0ea3a79eb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b206990-8276-4943-8f76-9c80164b6442", "sighting_of_ref": "indicator--45de40c8-653a-42fc-82d7-2958813a4d16", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4783adce-611d-4fa0-a9d5-6b2e9d19016d", "sighting_of_ref": "indicator--4dee0fe8-0b48-4345-865a-5abcf15319a4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27e4220f-0924-4f7e-96f8-8cc427db475e", "sighting_of_ref": "indicator--3af6ba5d-7af5-49c5-a2bf-2aefdc377793", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df7b308e-50cb-4d2f-8f1c-aa9423bb7eef", "sighting_of_ref": "indicator--b8afd7a8-9572-4096-af53-207238ce24dd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede34d77-c66d-4415-a83b-43d85bf10327", "sighting_of_ref": "indicator--a5f7a4b4-5034-414d-842e-aa33dda3fc81", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be670dab-d81c-44c0-bb5a-f7f879f738d1", "sighting_of_ref": "indicator--861f47fe-3f80-4e17-adbf-d2bfd69195a6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c365f6b-d0dd-431f-9774-0b269de267fb", "sighting_of_ref": "indicator--232d8d61-ed74-4e03-a97b-33f03cf6a1de", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f88d131-5c31-47d9-b362-251073bb597e", "sighting_of_ref": "indicator--6a2c49fc-8331-4957-9e8c-88b0a2a66de9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aaec5ca-70d7-4619-889c-12379b5592c2", "sighting_of_ref": "indicator--29ef88d2-44da-4827-9c9d-40ae1a20717a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b47f9c9-966a-4caa-b3ff-f5fe680ff2b4", "sighting_of_ref": "indicator--38321145-d55e-4995-ba79-e161b34ec32a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a08055c-3b41-4968-905c-349983b3c251", "sighting_of_ref": "indicator--8169408d-9a61-455b-9f7e-9913f2a58ee1", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ba1abc-6f59-4133-a401-01398834a9ac", "sighting_of_ref": "indicator--807f9f7d-0ea0-4d4b-9c57-ced01cfab974", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5cd6f6d-2879-434c-afca-e4779d92b90d", "sighting_of_ref": "indicator--fb457dba-f851-4601-bdc4-f5fd36d8ba76", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad682ea3-5602-42b6-8872-a170a26fe69a", "sighting_of_ref": "indicator--fbfa775d-f2da-44d3-bd20-b18d95adf06f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dade8383-7bff-49a2-a4b1-b85847055a66", "sighting_of_ref": "indicator--7c094f6f-12a5-4141-a928-017ff6a36235", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71795c5b-ac9f-4d89-8829-8846a4449d0f", "sighting_of_ref": "indicator--260082a4-c105-4913-a24c-4c69353151af", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eba1f2f-7570-4454-a7f8-0cefb239503f", "sighting_of_ref": "indicator--b04b29f8-d6b2-4678-9722-acf3f6e687ca", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd69fa1-d07c-4e41-bd5d-c3d42991877a", "sighting_of_ref": "indicator--526e1529-4ea3-45c7-9798-117cafafa052", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6c31cd-a234-4181-87b6-c669dc6b27d7", "sighting_of_ref": "indicator--599a3292-40ad-4530-a4cc-2f5bf28b264b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c0cdf3-4e34-4b4e-a20d-c26ca2a28cee", "sighting_of_ref": "indicator--0f51ae45-85b5-46ab-9040-42dcc8db3905", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca4d650-be9a-4922-bb26-6493b897067f", "sighting_of_ref": "indicator--0092e796-d938-4a65-a84f-2d784fb1562e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90d257b6-5e52-482a-9ed2-fa238c36b014", "sighting_of_ref": "indicator--f8a38c04-0c11-4375-99cc-f3062ce5edf6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48a764c4-b83d-4f7e-9bb8-901977b16ea4", "sighting_of_ref": "indicator--5a8405c4-af90-4b31-a29b-a548a7109a36", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a328f7c-1eb5-43b4-bbb3-3220a2251a41", "sighting_of_ref": "indicator--3c977841-a0da-49ad-89ae-13805604422c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aec4386-390c-44f2-8677-065b2d8b9e45", "sighting_of_ref": "indicator--7c72c54a-8d41-4dee-8185-230093632779", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a6c2508-c3bc-40bd-bdaa-87a7304544d7", "sighting_of_ref": "indicator--c862dedb-941f-4899-ba0a-18d2bef95aee", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f391ba6-7dac-4437-87db-3f31ac6c1625", "sighting_of_ref": "indicator--2ebe4db0-6ce6-4259-8c51-b57f11045dbd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04488ae3-ea28-4cb7-b093-569fac15a197", "sighting_of_ref": "indicator--6b4f34f3-2118-4c9b-8c3b-18e7e4718052", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4032789a-7be7-4d15-92ec-083adde2532f", "sighting_of_ref": "indicator--884075a2-37fe-4151-8440-24e4ef499987", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7cce39c-47ae-43bc-b3bd-b8814c29ad18", "sighting_of_ref": "indicator--481804cd-31a6-48fc-ad79-342abd810269", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81e29c87-22c8-4973-b4a9-5f8652a9d553", "sighting_of_ref": "indicator--d22aa8ff-f3d3-44a0-82e1-2199d426e0a0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--220858a8-45c1-4f2d-a028-a2907846301c", "sighting_of_ref": "indicator--8d2dd905-90f4-45cb-97e2-8efbfb898992", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20c22454-b9da-451b-82c4-d87087f2bee9", "sighting_of_ref": "indicator--c4b8d922-bcb8-495c-a57d-eb9b81ea0cb5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac23eef-f05c-4197-b99a-4d58dab3a183", "sighting_of_ref": "indicator--f0008fe0-e729-4726-9754-d51bde217619", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dc7867c-fcd9-4aae-ad3a-32b3914b4267", "sighting_of_ref": "indicator--4f84d9aa-70ba-4f5c-96f3-22791c97bf9f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed4e4f5-65a7-4030-9690-95a716eae445", "sighting_of_ref": "indicator--866e6edc-ddc6-46fd-af84-9630e7a7e684", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7df5977-69c7-4d72-a02f-c8451145a6f2", "sighting_of_ref": "indicator--4ff313e1-833c-48e2-86f4-67cfa80020bd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b0e1197-4da9-4b64-ba59-e5c75628014a", "sighting_of_ref": "indicator--7f9e9b8a-eb27-4a82-8a26-20ecf1229eb0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--205c766e-c27d-4cf0-9851-d95511ad072e", "sighting_of_ref": "indicator--945436f9-e0a1-4830-87f6-6f6c58a09004", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81ab3e3-a87c-4213-995d-b6074944a881", "sighting_of_ref": "indicator--8806c2f7-870c-42ac-9d00-5adcd16bb886", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a383b84-b748-423e-9608-79adc22c64a0", "sighting_of_ref": "indicator--46ee079a-2d3d-4412-9e03-26cb49eae66e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74cf2262-a84a-4af8-aa42-a152509f76ef", "sighting_of_ref": "indicator--c1e13f6c-4732-4383-a85f-1a8071d87675", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7e2f87-efeb-4bf4-a3af-5349dca6ad97", "sighting_of_ref": "indicator--f080c8c8-490f-4cd5-87b5-2eae5c8bfa66", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98afc8a1-f2a2-44c9-b79a-d7db1e7da03e", "sighting_of_ref": "indicator--8e288218-620d-457b-936c-fa920cf67b27", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7f67509-6a56-4067-b424-1aa7a43e4050", "sighting_of_ref": "indicator--c1084615-81b5-4c3e-b49e-1b898c9e6ed5", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d99959e-da50-4341-bd01-77b4bbfcaec8", "sighting_of_ref": "indicator--7f9c78b3-0d23-4cc5-a37e-7e3778accdf3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a62fc9e9-5fdf-4a5a-aa91-2329c4fac8bf", "sighting_of_ref": "indicator--b044e21a-2f5c-4eaf-8167-63a47043c468", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c93be09c-afca-4b9f-8163-a07e81d7696c", "sighting_of_ref": "indicator--52b4215f-55aa-4bf2-bd49-0dfe9d4652e3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09ee4a79-602f-44da-a551-54cb1e4a7fb9", "sighting_of_ref": "indicator--d8f70f93-d952-445a-af14-1611d922c4d0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6331e10d-7f6b-46b5-9ab8-2dfaaa9d70b3", "sighting_of_ref": "indicator--dbbd9ac6-df7b-4478-b9f4-7379ea418181", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cea7620-4ae6-44fa-85d5-3c1516b0814d", "sighting_of_ref": "indicator--6389fd73-622a-4073-84b5-9f751d58523e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd4adb91-f339-4cde-88d5-d8ef0a95bab8", "sighting_of_ref": "indicator--11f59864-674a-4966-93ae-c53b2e9140bc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd04ee9f-a309-4944-9bd3-7f34f4d76d8a", "sighting_of_ref": "indicator--2aa5af8d-da8b-44e8-9838-c4dd1f0af355", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12489e0-95e8-4b20-a11f-010b7b68e70c", "sighting_of_ref": "indicator--b6077465-bf76-4bf8-8644-82fa3c8a8fdc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f12dc8a3-8166-4504-8abf-8976e6750bb6", "sighting_of_ref": "indicator--7518433c-4be9-4b23-91ca-9b5605f233bc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f7ef8c2-710d-4ac4-a99b-9cd0dde9e22c", "sighting_of_ref": "indicator--bd642066-8bdd-49a2-9181-efca2353fe67", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ba8c67-aace-4203-805f-d46fcf91d40e", "sighting_of_ref": "indicator--77f6fe97-f641-4513-b7b5-92467e680542", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f8fa4b-b518-4b75-ba26-9ee7677fb9a8", "sighting_of_ref": "indicator--aa220625-1cd4-4096-9c37-27a72eca459b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--926a7eec-ed0f-4eb8-8b8a-a33469cb573e", "sighting_of_ref": "indicator--63d788e7-e7e8-46d7-81ab-1f12739d2a7a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75ce8c2a-8183-4d77-bac4-cc860758ac4c", "sighting_of_ref": "indicator--76eb80d4-6bc2-4ee8-a239-65e8d067feed", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af43bcc8-dbe0-40e5-8c0d-a3939a77b2da", "sighting_of_ref": "indicator--50ee99de-1824-40f1-a1b3-b407f802cdc8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c84fa739-6019-4946-8106-bf294ebff579", "sighting_of_ref": "indicator--7151d07b-0a4f-4d0e-8ecc-b84b528e0715", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--303a261e-5c31-40ee-9f64-2c175e184fff", "sighting_of_ref": "indicator--a492bccc-1da1-4bda-8f6b-3273a2367625", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c687394-7732-4c2b-ad41-8b4cbbfabafb", "sighting_of_ref": "indicator--fd05069d-855a-4b3f-89f0-c30791b32be4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55603e79-93bc-4ce2-a7ce-657f9f846bf3", "sighting_of_ref": "indicator--02092657-2627-45bb-afed-01497ce6208e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89aad39-996a-47e8-8b15-404aa8e87860", "sighting_of_ref": "indicator--ad0858dd-c849-4b2a-a79c-53c8404074b6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a44f9a3-7056-4ae1-a040-b633b5e6f2cf", "sighting_of_ref": "indicator--8d0299ff-ad64-44cb-9302-a8f6031fb652", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6bf88df-ce7e-4ecc-bf05-dc2ad329d06f", "sighting_of_ref": "indicator--e13e7e25-99d8-4f9d-9dd2-214409cc64c6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5448a17c-bf99-4244-a165-61f0e14560f9", "sighting_of_ref": "indicator--a08ecf1d-6a92-426b-9502-a7333f0e6c2a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--802a1b28-34f8-42b9-be7e-19015dbba710", "sighting_of_ref": "indicator--57d5d1bb-bb38-4550-9ace-bb159af80a71", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330f4f5c-fde2-4e49-8d25-5261fcc2d69d", "sighting_of_ref": "indicator--5082333b-5ee2-45f7-8022-d796d133c7f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46568751-fcda-4cd0-ad11-cf4b35ca60e6", "sighting_of_ref": "indicator--503cda4f-b4e7-4755-bcff-da39ceba90d0", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9502e85e-8615-4a63-b746-874a1f250e5c", "sighting_of_ref": "indicator--ae835225-7383-42fe-8f89-cab8783eb738", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f9dfe06-7b59-4a66-a057-0f6dc580cb2d", "sighting_of_ref": "indicator--99db0c04-4f55-453c-b4de-d752c5cec1d6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--780722cf-cdd9-479e-a8cb-b3bb41ae5e5d", "sighting_of_ref": "indicator--c3ed66cb-1f66-4da1-a644-1c0d5832ea62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed66838c-c22f-4bc9-8062-4042fb741046", "sighting_of_ref": "indicator--f9215fda-5ae4-4545-bee9-70c0f0e67232", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b518623-8e7b-485a-96bb-9eb789673a21", "sighting_of_ref": "indicator--92b70ad6-7ed3-4525-888b-798c6298ebdd", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13ce0fbe-197b-4c8a-bcd3-6ff083c9685f", "sighting_of_ref": "indicator--1c38a25d-4cc5-4db9-90b6-1856e348803c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23fe68d8-4811-40d6-bb17-2adbdc0b5fc1", "sighting_of_ref": "indicator--9e3ffd74-efc4-444a-99d4-465f1e84202b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--927bd7fc-2a68-4dba-8cb6-0eed3ca39f02", "sighting_of_ref": "indicator--94e638d7-415f-4454-9f55-bbfdc922ea29", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae7fb773-43f5-4584-ae80-737e334de35f", "sighting_of_ref": "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4316f94-8079-4ce4-82a4-ccfa72ecaaf0", "sighting_of_ref": "indicator--e4462baf-6e3c-46ac-bbd6-5eb9197b7167", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f4a34ad-2c23-41a6-9f1d-9f81ccc08b87", "sighting_of_ref": "indicator--830710ba-167b-480a-b7b3-f073490eda17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2679275-562f-421d-9ef5-b041a723d5e4", "sighting_of_ref": "indicator--89b96dea-9d82-408f-886c-a01b7995010e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfecdfb4-8803-4c12-8281-ba06e93ed407", "sighting_of_ref": "indicator--eb033612-7e20-47d3-8377-4b66ebc44b65", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--608417cc-f3c7-44d4-8355-9ede7c1d2112", "sighting_of_ref": "indicator--f181d465-ea12-46df-8f92-76b9168ad9b9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efbf0551-354d-4bdd-8a28-644f7e5f5ac2", "sighting_of_ref": "indicator--149756d1-6a66-417c-bfa4-c434fa5a0bc8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66316238-f899-4155-861e-9836754f3d8f", "sighting_of_ref": "indicator--4a0088c8-4945-47e0-b28f-eb14d3f065b2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f871cb-d3a2-4383-b0c1-90532b48ce5b", "sighting_of_ref": "indicator--b73afb53-73f9-4bb3-9343-03672b8d5718", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b70a762-0fd8-4816-9a15-0746e9f7b41e", "sighting_of_ref": "indicator--054a4096-a15f-4a7b-8e97-9526a3a9d22b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0da5129-3289-4ac5-96c9-feb29dd2dccd", "sighting_of_ref": "indicator--541a3016-e445-4046-8cf1-a9a5db49fd59", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90a6978-c09b-4dea-97f2-6fa90672e938", "sighting_of_ref": "indicator--566c6245-4256-47d7-aacb-11b58eda5b10", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2237049-85f3-4505-aebb-0bfebe297f4a", "sighting_of_ref": "indicator--d7bdcb9a-4830-4626-8864-f679a04f4393", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40726c97-0675-4256-be7e-5c5ed1887424", "sighting_of_ref": "indicator--1fd32b89-50e9-4b73-b86d-619725e9b97d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911db546-34a6-4b41-8f25-65628ce8ebe8", "sighting_of_ref": "indicator--c4b674f2-18b6-465e-b511-8102f05a577d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfdf733-2159-45be-8202-c00683c92abd", "sighting_of_ref": "indicator--9db70e13-8535-4696-94ea-a10d332e4ae8", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9353a0cd-45bf-45a9-b5d7-ec986278a5d5", "sighting_of_ref": "indicator--a2027c26-2849-4538-b380-501109e236cb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94932d7b-6cd1-40cc-b679-7a316743d7fc", "sighting_of_ref": "indicator--1136ab93-8abc-4e5e-88c0-23cfec1e0a50", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9513393-54b6-4472-951d-9c8509831eff", "sighting_of_ref": "indicator--105a1528-6ad4-4685-bc94-e142bf7a7b1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58e8fe94-6093-4ef3-a9de-7c9129d4bd40", "sighting_of_ref": "indicator--7d0959eb-fb52-4bf2-a3bf-f61ed86e535f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51205117-2e31-4126-a1c0-c1fd6a82c9d5", "sighting_of_ref": "indicator--fb515663-6447-42e1-b345-c737daffe178", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5234d1ea-5502-451b-a41c-8a8fd13b6b66", "sighting_of_ref": "indicator--f9448b32-4079-4e80-a48d-ee4c14995e3d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72eb86d1-6212-47da-ab25-9810be4466fb", "sighting_of_ref": "indicator--5475a06c-0cf9-436a-af81-0ea7bf6acac4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76e1cbbe-0d68-4bc8-97ac-a95f1fc27832", "sighting_of_ref": "indicator--32a00c5b-6ead-4b40-955a-dc8d9c4ef6db", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55943b00-f817-448e-a3c2-0cb4af6d74ea", "sighting_of_ref": "indicator--250a4fbb-cbae-47e8-ac3e-b527b737fa05", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b745345-8ecc-4c19-85b9-ccce4037ed8c", "sighting_of_ref": "indicator--f508ba95-5e81-4f9c-9354-bf50f68f1d5a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23235170-8051-429c-a5e4-c78e374aa99e", "sighting_of_ref": "indicator--e52092e1-4bc7-4bdd-978a-03081cdd777f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c6ecda-cda8-4693-84de-edcbc777556f", "sighting_of_ref": "indicator--ca3e0253-882c-426b-81ac-87b7659a2174", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11aebb66-2149-410b-b981-32938c0cb83b", "sighting_of_ref": "indicator--141c85d6-6314-478e-991a-51284f61e207", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eafbc56b-e968-43b6-9638-647afb3755f3", "sighting_of_ref": "indicator--9dd9c23e-96d0-4487-a99d-6e75da8d2e6d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5caa4c27-4d58-4cdd-a25b-93fdac4385c4", "sighting_of_ref": "indicator--dd45877c-d3d9-4d13-bbce-db0132f05c3e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf6b1b1-ae47-4cdd-95f2-677327d1d7d5", "sighting_of_ref": "indicator--e5d4354a-7f4f-4472-bb5b-d1794fc1cada", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb7367a6-d634-42a4-ac1b-8ffdb0d7b1c8", "sighting_of_ref": "indicator--a0b411d4-eaa2-4fb7-ab88-d4925a3c1c80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0408e97-0480-4c3c-9e80-7399015febc9", "sighting_of_ref": "indicator--b1b7c6ca-ba48-4b0f-b60a-796afeeeb460", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea1b43cf-57bd-41fa-b11c-fc39848a5d54", "sighting_of_ref": "indicator--391b48b0-4667-498a-923f-de04835a656f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1713f994-a1ca-4ebe-9274-f2a018dad421", "sighting_of_ref": "indicator--1c3a2f1c-e85a-4649-9c70-af93f6464739", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6687848a-41f1-466a-ad32-7bb983fe731f", "sighting_of_ref": "indicator--e9f9a454-3596-4b0c-aaa9-468cd91bc056", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2ffac2-6f6b-4778-b0bd-b8f9d6b59ffc", "sighting_of_ref": "indicator--35180f55-905f-403e-93b8-0f8b21fe4e96", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--833115a1-b9db-4339-8944-f2fc0387f20b", "sighting_of_ref": "indicator--1a7fb018-c140-4eb4-b190-c7f5ae1b83bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e091a1a-1a23-4841-8e54-b3bfa3180a40", "sighting_of_ref": "indicator--d72287aa-9dde-4465-9bd2-f40d16774194", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dda864b7-9965-49f5-9b09-89977ddb46f3", "sighting_of_ref": "indicator--6935ee54-f030-4dfe-96c1-4a81d88874db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a93b222-82a8-4ec9-93dc-3ba1d6c5b6c4", "sighting_of_ref": "indicator--58cb1183-85c4-4464-93ea-ee59f26c7c53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d13b73-dfbe-4171-99f6-b4aa7b4d24f7", "sighting_of_ref": "indicator--13a0e442-e337-4312-8506-3f23bdb76cfb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61e7676-c262-4c42-b5e3-351fb6965d3b", "sighting_of_ref": "indicator--a6f8d4e8-ce04-4448-bd8c-ee5f0667299b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6444c9-37dd-4ee2-8cda-6fb24f09f281", "sighting_of_ref": "indicator--e9509306-abcd-4719-b33f-3795b1de006a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02356d79-2e64-4685-8676-503d74b42aeb", "sighting_of_ref": "indicator--107650fc-b81b-4413-9cfb-3f622521c3f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c469c2f-ca25-4798-b9f6-5f27b5606ec5", "sighting_of_ref": "indicator--8344c885-dba5-4b33-8668-493b986a00d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10010f61-83f3-4d18-91d0-efacbdb621e3", "sighting_of_ref": "indicator--5fd50a3d-45d0-4b34-b0ff-9dd2080fb97f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9ff3cc7-1c82-4fdc-a808-289f0fe1f76c", "sighting_of_ref": "indicator--08be91e4-cd76-439f-8c61-098104b4dd7a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a57764-a48f-4fe9-bb11-22f38d6a8a84", "sighting_of_ref": "indicator--0801fff5-6b74-4022-9c4e-fdeec00086d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad953eaf-71cf-4ee7-8b39-2d88dcc54817", "sighting_of_ref": "indicator--8731ae65-5c26-4704-a965-73c49ffe26bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16011035-5fae-4787-8a0d-ccda26a6f209", "sighting_of_ref": "indicator--e6fa47ce-72dc-480e-8440-d6e4995a39c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86f047d-a217-4190-b145-d4867383c279", "sighting_of_ref": "indicator--33efab7f-03f9-4944-9611-b978d9125fb4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f84391ab-0f58-441d-9fe0-9b233063548c", "sighting_of_ref": "indicator--61cef3b7-3344-4e44-a002-46182eed0467", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a2c520-f146-47fa-83a8-c79ff2fe8f2e", "sighting_of_ref": "indicator--7fe3d479-bb0d-4cc6-a995-62e20adac30c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5126b2ba-56eb-4357-bd48-56c7655e095d", "sighting_of_ref": "indicator--79303527-87be-49ae-988d-b4df9d176055", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5394c6b7-480f-4f26-82f7-2eff38f0ce54", "sighting_of_ref": "indicator--f75c1e99-6269-4963-b2c3-b735f5500109", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2050a4a-3f23-4e79-8992-b1d61821acfa", "sighting_of_ref": "indicator--1e53b280-b4b6-4cd6-8dc4-06a5f83742ae", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ebac89-27df-48ae-b976-80708bbe219e", "sighting_of_ref": "indicator--31aa528f-0896-42f8-9cba-85e687453e2c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffd25c51-e421-48f8-b9cd-f613ff2afe0b", "sighting_of_ref": "indicator--6f599d54-b078-448e-bd83-968acd8f0825", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a94fa285-8ab3-4e6e-8ba4-cf1ea5d58ac9", "sighting_of_ref": "indicator--cfc8a06f-d451-46ca-aab4-804846ff25be", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75c35dbe-887c-4042-aa78-47bd2a168ed5", "sighting_of_ref": "indicator--4dfe733e-6c81-49cc-8e39-bf759e8a9a4e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a2c6f1-e72f-492f-9409-87e70297d0f0", "sighting_of_ref": "indicator--f4ee3e94-81d9-4f76-aa79-7713231aaad0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46fe8246-8743-4efd-b580-b0cd0bb07c34", "sighting_of_ref": "indicator--d7f3f5e3-33b0-4d10-9a29-4887c2605313", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dc4b1f0-c8e9-44a4-bb44-79cbae75779a", "sighting_of_ref": "indicator--07f42269-1d19-4625-b002-37f3fefc9730", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cada6632-691e-4dd3-8e64-02c4601b568e", "sighting_of_ref": "indicator--6d44b472-5dff-4edf-91cd-6cac8c33b75a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2949adb-dbce-4137-a9e4-1fd5e417e5f0", "sighting_of_ref": "indicator--9146cfe4-dec1-48fa-b28c-afdc7ee94c32", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1bc209e-d566-4a9e-b337-59a341eec0e3", "sighting_of_ref": "indicator--8c8f7a0a-7363-4474-8bcc-77773be89c8e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a02ec11-06e4-4963-8468-2b35a0776f85", "sighting_of_ref": "indicator--d63cd466-7e82-4002-82fd-1b7150adb270", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55fa9804-7d64-4f26-9cac-70c0b1b2f797", "sighting_of_ref": "indicator--6553ca75-3925-4275-9ece-11f3a8452d70", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81b4ca1f-91d4-4809-b1a9-d3bde03d1474", "sighting_of_ref": "indicator--d084e9cc-98e5-4594-80ec-eb51894a4efa", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fee1fe77-9d05-40d0-8018-42e4df317438", "sighting_of_ref": "indicator--0ba78612-58b8-47a6-bb86-dc957975d83c", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d94e445-8693-42ef-bcc3-62f75e573685", "sighting_of_ref": "indicator--fb155af0-47e5-4f1e-8615-9395d2439fa2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c12c1dc4-d014-4878-83e2-f660f31206e2", "sighting_of_ref": "indicator--9461d3c9-6651-4531-b1e2-ab355db9a60d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d30b0895-f476-480b-9549-f2968ada559a", "sighting_of_ref": "indicator--51e871a7-125f-43cc-992a-2212c216cec3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf8191a3-6dd2-400c-aef2-abd6085c9dbb", "sighting_of_ref": "indicator--f8721a3d-147a-4b07-aae5-a0c497eb6602", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce22ab26-53a9-4add-97b1-4a005c302024", "sighting_of_ref": "indicator--b69dd198-de6f-4280-a755-4ef0df4c3e20", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab406644-a613-4dd1-aa9a-e82cc0fccf23", "sighting_of_ref": "indicator--b8c77328-251c-47c6-9758-ac469bbb5ff7", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a07922a1-cda7-48dd-a636-df353402e962", "sighting_of_ref": "indicator--11bca421-df99-4689-bbe0-75af509666eb", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c0760f-691e-4802-b110-62970d1ecd4d", "sighting_of_ref": "indicator--706785fc-7124-425d-a3ba-4b168fd683f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7518215-9a91-4a01-8325-ddbc4ca61c9d", "sighting_of_ref": "indicator--d92118c3-225e-4bd7-b8cb-ca62db3f52b4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20089678-6ccc-4dec-8dab-d5fca7dfeed7", "sighting_of_ref": "indicator--48b58123-5642-4bc4-937a-33d695eaa336", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b5eaa13-514a-4603-8834-2e750cce3492", "sighting_of_ref": "indicator--cfd9361e-00b7-48f8-9761-b832a6aba5af", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8de2cea-2954-4ae9-a6bc-594333e9af3a", "sighting_of_ref": "indicator--e3384756-7e8c-4a8a-96ff-6d448cc5d323", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30684c38-3a62-4c74-b85d-c3d41557aeec", "sighting_of_ref": "indicator--b7fd370e-2138-498b-aacf-8b7f177a692b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6e5bb6b-18c9-4ff2-a0a2-d706efdaa757", "sighting_of_ref": "indicator--152225d2-a5c4-43ac-b40d-aec7758c6bbc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df362ec2-7901-48cc-bf0e-cc36303d6ef3", "sighting_of_ref": "indicator--4356c39c-0a4d-4351-9b83-57e1be650d32", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f3f624-d684-43a3-86ae-e37e36d92e7d", "sighting_of_ref": "indicator--18763a33-c55e-4f43-9f5a-c30b30d2d260", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cd0190e-eeef-4fc7-8d70-993fdc215da7", "sighting_of_ref": "indicator--1335fadc-9c1c-4e11-9907-1b25b58b9886", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34deeac3-71a2-49b2-b79d-568ee036e73b", "sighting_of_ref": "indicator--40f79bda-ccc1-470d-a66b-8154132e5c47", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d99df0-6fd8-4ca4-ae27-1f097f96690b", "sighting_of_ref": "indicator--a62ba161-9e28-49c6-bdf0-39fd4137e71e", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa283e0f-364e-49a9-8b6f-8e87a8f50ab3", "sighting_of_ref": "indicator--22b6556f-1b21-421f-9be8-dcccb8dca126", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3cdca7-21e7-4091-8638-4c0790575f7c", "sighting_of_ref": "indicator--bc63d9a2-da16-43d5-ae06-c6e9f50a0d39", "where_sighted_refs": ["location--e87cc564-5c89-4d25-89bb-d490d876a872"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f06f70d1-a9c9-4c53-86ed-83ea2c81918e", "sighting_of_ref": "indicator--e8d764ee-18e0-4fb7-9189-b39f7576cdb0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82e54a78-1a2d-420d-9506-3059ba717ec0", "sighting_of_ref": "indicator--c4596a1f-d639-4b29-8650-34b6b5717319", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6cfb86c-0079-408f-a1a5-36d0ab40940c", "sighting_of_ref": "indicator--932bbffb-6a20-4498-afe5-f849c82d60e3", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d45aba9-207c-4379-94f3-2969a98d38f6", "sighting_of_ref": "indicator--7e11f502-9037-4dcc-a13a-798858cc119a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75f9ab5-7392-4f5c-b72a-4a24c42c00d6", "sighting_of_ref": "indicator--fea85744-f514-4e64-a4ec-50d62c36acaf", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35c1e600-0622-47ef-9374-f0cb3e8b303d", "sighting_of_ref": "indicator--e00b9d90-19a3-4563-8fa7-dee580cc043b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a314d77-b3e8-4ebe-92f0-678cb1676dd0", "sighting_of_ref": "indicator--5f344702-3b5b-4fe2-bbab-94ae27e4a05a", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d34049e-d5ba-4c75-8fa6-4008ac9e12be", "sighting_of_ref": "indicator--bc05b90d-f5af-4bb9-b87d-1a9ff44fa911", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7994d5d7-9438-464b-9ca2-235d8f5597f8", "sighting_of_ref": "indicator--1ff5a3ce-58ca-43a6-927c-b1dc1f84bbca", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c1197e-f72b-42fa-ac95-cad6faefbe2b", "sighting_of_ref": "indicator--0c75b8d1-250f-4f39-a336-8210a1541c27", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c96303-983c-4837-a189-db403dd9c4ac", "sighting_of_ref": "indicator--58cf1519-8191-4c5c-9fd8-c9c98f2bda5f", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca05d0ff-b3a7-460c-93ed-7ee1c16cdad4", "sighting_of_ref": "indicator--fcf1a80e-5eab-44e4-a1ca-a4d6670844d0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dc5674b-599e-4561-8bb0-79a5168810a1", "sighting_of_ref": "indicator--b61ed17c-fe57-4540-b304-5960f56bf6b6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fd7188f-cce9-4232-b94a-70bb9cc19cc1", "sighting_of_ref": "indicator--8fb3856c-99d2-4fee-8fed-62d30152d7d0", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e827b718-8494-49d2-adf3-36ec1e83ff17", "sighting_of_ref": "indicator--e0a307a0-3947-4425-b913-42ad8ae12cd2", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cdeccf5-fc2c-4842-ae81-3f70a9c44712", "sighting_of_ref": "indicator--784e8dfa-3302-4e4c-b950-5a2aa6f4913b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1cb744f-70ac-4d39-bf62-4a339d3d89eb", "sighting_of_ref": "indicator--3fe29ae1-9490-4c57-a55e-0ff858c6efb9", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e6a9dfd-04f2-4110-81b4-82a3f541f29d", "sighting_of_ref": "indicator--0e64bed6-5e88-453b-9de1-34d4ff078815", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d6b4835-b7e7-4558-8c72-e3c345bd234c", "sighting_of_ref": "indicator--843a2919-8dd0-4146-a92d-c3b3283684dc", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff9b80c-8e3c-40ff-a620-e840a832cfa3", "sighting_of_ref": "indicator--cc9019ca-9979-4d3e-93cf-1b0b071a0a56", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e73cd3d-6689-456c-a392-92bf88641fa4", "sighting_of_ref": "indicator--43b94030-e725-417c-9c73-b6a009e16c3b", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0bd8f5-6568-4806-8265-01e9faf3c17a", "sighting_of_ref": "indicator--94276aea-790f-4b9d-a407-918032272772", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9e9d65c-5bd6-4113-b301-55e465f90aa3", "sighting_of_ref": "indicator--20f6ae87-d2fc-43bc-b062-1f0bffda1ce4", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1326455c-dd0a-49ce-9e5a-cc760e91294a", "sighting_of_ref": "indicator--82fb52cf-4724-4822-a195-5bdb44a6526d", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7c73f5-eeaa-472d-9f5d-e88a7c986c78", "sighting_of_ref": "indicator--448ddc1d-72e4-4971-a758-be00d13defa6", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2782e5-1c0e-43c4-a6a7-0ab4413b0434", "sighting_of_ref": "indicator--5544294f-7885-408f-b180-0e3f60d7d7ee", "where_sighted_refs": ["location--d6a19120-6b83-4b32-bce3-2e32340b0449"], "first_seen": "2026-10-05T00:00:00.000Z", "last_seen": "2026-10-05T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--3a93221f-c294-4dbe-b3b9-40e8b681b822", "name": "Threat Report for 2026-10-05", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-10-06T11:00:01.960Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--e87cc564-5c89-4d25-89bb-d490d876a872", "location--d6a19120-6b83-4b32-bce3-2e32340b0449", "infrastructure--3b8cfb57-49d0-4656-bbf2-8322736e9490", "infrastructure--de9be1ea-bd15-489d-b9de-006fb4a34143", "infrastructure--a58f011c-4b1f-4b61-9a9a-3c619246eeb8", "relationship--b6fac519-7645-4432-a181-6f3b9e6de6b1", "infrastructure--3769db15-f502-451a-b20f-efa2200da10d", "relationship--000afceb-ff92-4d80-8434-3a96113fc78d", "vulnerability--b1fa8223-720f-4609-966c-aa8ad20d832c", "vulnerability--cf380ec5-8d65-457d-9200-af9f7ea3becb", "vulnerability--b374f560-b416-4f5f-ac00-07123cb91230", "vulnerability--783eaf01-1f68-486c-9e37-4a241bae87ec", "vulnerability--43644ded-6511-4e24-9784-f2a53bc94180", "vulnerability--9dc8500c-d809-400d-9cc5-c60f574d889e", "vulnerability--aa103677-613b-4076-b298-c5869231420c", "vulnerability--cceee095-1214-46a6-b5b5-d2e205f87c06", "vulnerability--36cfbfbb-2e64-4786-9fc8-eddaccba8c36", "vulnerability--21e79671-997f-4230-8d54-031cd20c2a30", "vulnerability--c58378f5-c893-4c8e-a248-2f625a13cb7a", "vulnerability--b79e1843-cd23-4fd2-a55f-2d272fd4402d", "vulnerability--92c2dcbb-4629-4c79-89ae-52aa5624e7f0", "vulnerability--c2afc884-176f-4ac2-9e9a-6dba70cb7a16", "vulnerability--0ad984bb-fc79-41fc-9866-07b36e5471b6", "vulnerability--7ab1b8e2-0e68-4add-8d99-3c5f05b19be9", "attack-pattern--46456da8-2c12-4da1-bc3f-cc2405512164", "attack-pattern--6ae2a860-f20b-4055-823d-4e7a9028965d", "attack-pattern--e12cf776-1a1d-4201-8109-c247b71c5d28", "attack-pattern--d8d583ba-957b-4d32-87ab-e76638e426b4", "attack-pattern--982b846d-1095-4d39-bea2-cf3e5eb7a9d9", "indicator--1c788e90-d30f-4966-a4e8-384c043bc91f", "indicator--1fa3ee1d-0735-4b7d-9f8f-fe755ca050e0", "indicator--ee593410-b324-4487-adeb-9f4c6be1d73c", "indicator--62065999-9c75-49b6-8950-f57d90cfc5fe", "indicator--f4c3ac97-d34b-4622-b89f-03666d6f61d7", "indicator--c323bc26-ba4d-4422-b7cb-139e8ff2efe7", "indicator--7ed528ce-c40b-449f-a169-cd3177584067", "indicator--7d368e9c-fac5-4b62-be04-d7627e59e62a", "indicator--310d37b1-764d-47b6-8b7a-39ae3b3d1b72", "indicator--115953e6-a765-4e10-a5ef-503e15c7b449", "indicator--36452deb-3088-462c-b4b2-0c4742e23e94", "indicator--9204065b-55ff-4128-b919-d402fa6a888c", "indicator--87a6e2c5-148b-4da6-a8a1-48825de7d00a", "indicator--7ca16a1d-e7cc-4e5f-a410-8661e4c2167a", "indicator--3cfb910c-bc2e-4ea6-b73e-d232ee195a4d", "indicator--6bbfebc0-1bdd-45b6-bca2-89f909e49e0f", "indicator--1337c3dd-77ab-4bb9-b9be-ca5b24cb66c3", "indicator--6da31cc5-6030-4f57-be1f-27ec148f8252", "indicator--5aefcddc-f63c-4792-af61-15c86e0d7ae5", "indicator--7a487ba2-7403-4b33-ab1c-3a39075cbc21", "indicator--b3349855-19fa-472f-9e40-46ad10a27957", "indicator--dbc86e0d-fe04-40b1-81b9-77ce71238e3f", "indicator--fe8edd9b-ff34-4010-9fb0-da2de6ddf5ef", "indicator--a8d3911a-a4ca-4c97-a2e1-4dc693c35b7d", "indicator--72ef60a8-7403-46e5-a91e-a20f61328bba", "indicator--54e35913-ecb5-49a0-9a9b-ad3e938f26a7", "indicator--6105da02-bcce-4559-9680-2762c80a6293", "indicator--19be2b9b-84b2-49b6-9969-f8a4c011ed4a", "relationship--b54ec8da-ad48-4fe1-8fe9-799958e7a494", "relationship--89071d3c-35a6-4924-9b94-9e19f9d8cff7", "relationship--c55f0ad1-abb8-4578-a660-3564f6013135", "relationship--13901d4c-3697-4f34-9304-bbd603a19ade", "relationship--5a314e1a-1de6-4f2f-9516-98e232b20f0c", "indicator--64a5ce77-e3ef-4b61-8c59-d2898673e664", "indicator--38c35ccc-d906-417f-892d-f3a376d30f92", "indicator--89af7f33-8129-4252-a746-8631320d064a", "indicator--31dc1bb2-3e06-44a6-b576-926a38f55555", "indicator--76893952-26df-4804-9956-2c3072e508a1", "indicator--7bcd400f-6a2f-45f1-afaa-74c6e280f14a", "indicator--aac4a3c2-1ad9-49ef-8c2e-9e9785021bd2", "indicator--4c92c47c-3b1a-46d4-beec-7a73b1a69ab0", "indicator--eabe3166-a141-44da-97c1-6027326399a6", "indicator--078ef465-8c6d-46c3-b4c1-d70ec56feca5", "indicator--eed28e64-d1ee-4ad3-a100-4fba92650da5", "indicator--ec7fb4d7-775b-4681-b0c5-f3ab43c13d61", "indicator--838f8d5b-5ed3-4eb3-bba5-5834290e4936", "indicator--d3dbc91f-99dd-4b36-a61a-475788268aae", "indicator--3cd52c18-5026-4950-965e-285c5b7ac1ff", "indicator--2df0ae6d-4b4f-4010-853f-d609ef657ed2", "indicator--7aad4bba-6d48-4967-a199-07258e1f54cc", "indicator--2cd4c0f4-bffe-4c58-a78e-0d0fa3355dce", "indicator--978abfe3-5aa9-418d-87c4-9830be7bddb8", "indicator--b9ffcd81-63df-4234-9e70-50ec3b7d647a", "indicator--11da9674-6270-44db-ba98-697041210795", "indicator--c2772999-de90-4470-9f86-73c48acd65e8", "indicator--fb88843d-6110-41f8-beba-bb9e7eebb9b7", "indicator--4a8cb174-cc53-4e61-830c-cbff9f809a48", "indicator--6cff31d8-62c8-4d2f-ac75-49d3af16354b", "indicator--77180521-08c4-454f-8991-09f4e96685de", "indicator--d3544395-2a00-40dd-8250-433d0d6b2e66", "indicator--e53804c2-db0b-42b3-b4ed-ae978cd06409", "indicator--2c0176a5-93f1-42dd-a0f2-d200ac1bea72", "indicator--229701df-1415-4276-a98c-bb0a30eb78a0", "indicator--be07f34d-e486-4fda-9fd4-5c065953223b", "indicator--57fb28cf-8b2c-4897-a0e0-04483c9301d7", "indicator--d9f4478d-1294-42c3-a9c1-503711c290fa", "indicator--8b04a7fb-35b9-45d3-98b2-e131b8644ded", "indicator--ec9d70bc-fd57-483d-94a9-d1c62ad15783", "indicator--2ac13b3e-9c91-4113-94e6-aa356a61cb5e", "indicator--5e5fb8d5-6743-43af-af2a-fe4dcb706f43", "indicator--c7084dc4-e0b5-4588-a40c-7fcff8b28d2a", "indicator--41dab32e-17ff-4f6c-af20-c36f4344a7f1", "indicator--0b6c8e8e-2b2b-48e5-8eb3-baf32ebbb8bd", "indicator--1700e3f2-1945-4768-a4ae-bc5dbcd47ead", "indicator--93eab4cd-9d77-4455-8d2a-d3df493a7d63", "indicator--d1217b78-1d39-4b70-a4f3-5a020fbcb988", "indicator--02f61417-cd0d-415e-b7f2-e8a48e84dca3", "indicator--688efdae-2d48-4d61-8962-6ee142de030c", "indicator--48807465-9812-4eb1-b786-b2b972fb53f5", "indicator--946162f3-7841-4ff6-91af-4d1411ebefdb", "indicator--6a796800-d2e7-4851-9f1f-2e2a1f56ac92", "indicator--c3950cb7-9e67-4f3e-9601-ca70872a76a8", "indicator--efec14b6-cfa7-47c0-8517-0ac804c4a52a", "indicator--aa90475c-7500-490f-9dbe-9af3dc5f4417", "indicator--fb1fd99b-3628-4247-80a6-861875e2ab4e", "indicator--3eed1065-d72f-4fc9-9efa-febfa2f6c90b", "indicator--69eb5c4a-c619-4327-8136-f8718f5254ab", "indicator--3769f2cc-54ad-4ea3-af84-38a7be8a2dd1", "indicator--383c9bcc-70c5-4c34-a2b3-25111bdd3fe6", "indicator--ea0aa0eb-9a2b-4fac-b81e-1c275764addc", "indicator--92249c03-b843-46a8-8f46-f2a129f683cf", "indicator--1d047075-0a31-4dcf-a839-d211697cc501", "indicator--a0a1ee3e-12ba-41a8-ae03-24586d8665be", "indicator--9b88f0f2-2d87-4cbb-82f9-ad4723a0eb97", "indicator--c49a220d-4c92-46bd-b036-70fbdb1d4b7d", "indicator--1355c492-51f0-4099-b0a1-2eb5d612db15", "indicator--46b3b389-65ce-4891-a744-d4a01f628c50", "indicator--0103362a-51de-4eec-ab05-6045808b62a5", "indicator--ee04f536-5e66-43ed-9749-327393b1fc09", "indicator--f03025b2-11af-46ea-bd6a-e43778e64eb3", "indicator--85886315-f345-4d46-8fb1-1b2a1591f773", "indicator--e19cf0cc-f484-4db2-9047-c89771b3ef6a", "indicator--bdeb54a3-9941-46e9-bd95-6d3acf7980da", "indicator--50eec09a-4cb2-491f-8b0b-9329a41ad1f3", "indicator--96e45c91-46a6-4541-986f-a928d94f602b", "indicator--ee87b866-e839-439c-ba8a-003a505ccbc0", "indicator--3100041a-12de-4692-acee-3d7d6f590571", "indicator--186d9956-4813-4cc0-8ab7-d6457313ba81", "indicator--ac6f0b9f-ca3a-4877-b12c-fe1141978a54", "indicator--87beede6-491a-474a-b8a2-21fe7f6650d2", "indicator--088e50b5-a9e1-48fb-b6b7-f7d956228a5e", "indicator--f03c3be3-db60-4d3d-941c-c050a792f510", "indicator--17497023-7512-490f-bf58-b8db6f39388c", "indicator--aabc7df3-89f6-4a83-a787-bffd41249b8b", "indicator--ac75f9ea-ec6f-4b2f-908f-5df97769f6e1", "indicator--e41abdea-59dc-4127-865b-40b1cf4f9979", "indicator--d2900474-e1df-4b55-9914-3d26fe724d4b", "indicator--ade3a4ea-ac39-408a-bcd0-049be4d01829", "indicator--83c21403-7a11-4b9e-a1d4-424d2ee92d63", "indicator--fdaf1bd8-f609-4a77-a543-ad3c08c6551f", "indicator--a96d8e07-662a-49ff-a8da-4bd27ac35b0d", "indicator--41a9d5be-a741-40f4-a966-bc1d13ebb01e", "indicator--11d38535-250a-4907-8754-f7a974ec0d44", "indicator--a3aa7ea4-6bec-4387-ab35-28a0bf9bfefc", "indicator--7a0df9f1-2458-4ecd-9388-fb202f70adde", "indicator--23c69791-5e57-4e8f-a9d5-9f5dcf8b6be7", "indicator--a9f19656-fcc0-4090-9152-6a3768657702", "indicator--dd5c8fc3-303f-466b-8ad4-f64649c03f39", "indicator--d4a46c4b-719a-4a4e-96fb-964301dd6981", "indicator--a5da5154-aa57-4d23-abcf-0f3af6f74f7e", "indicator--3ca7b882-a992-4bd3-94d4-ca5386611554", "indicator--7d58ae46-489c-4f1a-be10-7bb423c55a44", "indicator--a645dd3a-6bce-4411-9ed6-2787ad05d370", "indicator--68369a59-63d1-4bcb-98b9-8299d8214153", "indicator--d47c7e50-e9e4-44d7-abdf-94a17383f430", "indicator--5681c976-f32a-4dd4-842b-94912f72d238", "indicator--ea56f262-225b-4dd0-8d20-88440454e6ed", "indicator--4d685ff9-c1b9-45d6-8939-015f12f57c7b", "indicator--99f61efd-c4d4-4e55-be4f-329be12c1b51", "indicator--d29ed995-1f2c-4e04-8a57-71d387b0ea4f", "indicator--884a8b06-d5d0-46f3-b34b-861f8da61f3c", "indicator--7ac3b360-13ff-47db-8efe-47701df03403", "indicator--6cbea82d-2984-4c6f-9506-165ead21e63c", "indicator--a97575e5-1b7e-4053-a912-92a7e95a790d", "indicator--1b4200ae-492e-422b-af03-14677e9567b8", "indicator--42d0776a-1605-44c1-a5f6-6f84f702ffeb", "indicator--167b3b57-ee03-435e-9ab9-760f1b39c401", "indicator--d82a5dc0-7719-4d23-86fd-d6f50c3c269e", "indicator--d2be9c84-22ff-4253-bfb0-d8a7d8eba858", "indicator--cf523495-19b6-44f1-bf64-806dcf71b997", "indicator--44546e43-4fb7-4022-8e4d-bdffa5c26ccb", "indicator--711f7267-7850-45ac-9662-ef0a8cabf191", "indicator--f944aff7-9ef9-472b-80f3-9366e47d572b", "indicator--cb1ea2a3-433d-41a1-9940-c24a16df36f3", "indicator--888c2c81-18ee-49e9-977f-ac8d67a40825", "indicator--b2cc45fd-85a4-445d-8b25-df6af8e6e342", "relationship--6cc1426e-ca5a-483f-90a6-e85812e6a982", "relationship--3f502ebf-a6c4-4728-87ae-9b9f07f7dbe2", "indicator--49583b2e-5061-4d3d-adf2-a88d87f59677", "indicator--8b4ff66c-3f4a-4707-aef8-70ce63abdf78", "indicator--1d1aa688-9966-44e7-9070-5ab4fcfce23a", "relationship--15ee3d10-7c8f-46f2-a364-74418024f33e", "relationship--a71d26b1-16fb-43e1-840e-9b1a2ba285d5", "relationship--5811c189-02f6-45e4-9b5e-7fb47d2b9294", "indicator--60e8b465-d70a-45f7-8fe5-f9e97e2d7848", "indicator--f48e7397-9964-481d-bf27-bbf2d3f6f68d", "relationship--77cb708c-7786-4feb-a70f-66db2cbf19fe", "relationship--3f7a8770-937c-4cc6-83b5-0750e4715577", "relationship--31dbaf37-0305-48cd-96d2-6e2f15deab13", "indicator--4f4c19b5-8f60-4e95-847c-ac2a98102392", "relationship--0668c9ef-e599-4ad6-9ec4-e55cc3b2d58f", "relationship--f0adcdd7-e297-44f0-867b-5d6ee2d8041f", "indicator--f988873b-924f-40ba-933e-020e32a4c8ab", "relationship--f2d21443-0a55-4cd0-9741-db9d2fd91563", "relationship--6c0ba157-723c-4ac8-906f-02e6769a2005", "relationship--0171ffcc-b517-45f7-9c2e-200b682714e6", "relationship--b61a3b58-42f3-4b73-a92e-b1ee5c9bec9d", "relationship--48c4753c-09e2-461d-9e28-02bbe52eb220", "indicator--2036033f-197c-4623-b22e-45e346a5dd44", "indicator--aba526e3-6ed3-40ce-943a-346b68c25b60", "indicator--49c6633c-ac95-4ecf-a490-d244c183f618", "indicator--be04f8a8-51fc-4402-80a7-ead21073747a", "indicator--323e10dd-3205-4611-957d-ef9c2a98add7", "indicator--ea7ba9a1-8a23-46fd-9923-1614ff63dc22", "indicator--4e825016-d1f9-4612-84e7-49f6e1d1a111", "indicator--4386b2f0-6f72-4b32-b772-b29a7a6495e3", "indicator--e1944a50-5ffa-45c5-925b-9616f3a79d15", "indicator--88dc3797-60d3-41e4-90c8-9851a70d9336", "indicator--089e16a1-aaa0-498f-8188-43a998571ee1", "indicator--356f2393-326c-4e85-acc8-e50c146e7a0c", "indicator--98549d47-e451-43af-a804-05c481b7b06f", "indicator--dadc0f2f-db3b-44e5-a221-9cbd95fd39df", "indicator--f9024cb3-d832-4cf2-8709-60a39f067ede", "indicator--844f103c-a07e-4f28-bf50-7336be53f305", "indicator--a7ba933b-69d8-4b8e-b7f2-d65f2b16352e", "indicator--e3059fab-2be2-4a23-a51a-2f649786de7c", "indicator--06b88f85-d851-439e-b09c-6f23c08a1ca7", "indicator--29625a5e-f312-4451-ad47-4b7e3893454e", "indicator--a132b640-10a7-4876-a5c3-41e8688b0262", "indicator--803c5bc8-bd50-4ff7-94b4-04fdda3d156a", "indicator--cc249ae0-22f6-4235-9a4e-113e14e0a6a5", "indicator--74a69120-7df9-4cfa-8d8d-09e90a29b9f7", "indicator--dbcd9aa7-e67a-4eed-a2ff-7f593d1fe6d3", "indicator--38fa3797-bec0-4f26-92e2-02458b005a76", "indicator--a236e0bd-f121-41a6-972a-98eed1cec8f2", "indicator--164b5587-8add-4a7b-a080-54d413a7cbb8", "indicator--db0cba17-68db-4af2-a2ca-55cf5402a8ff", "indicator--24b53fc4-959c-400e-92fe-d978bf0d387d", "indicator--7a003115-5316-4e39-8cee-d7cefff29518", "indicator--de1287eb-38f2-4d73-9f4f-46356832f6fa", "indicator--a78a4af0-75a2-4dde-97a4-15a5e9158079", "indicator--6377c35d-82db-4868-a047-aa3a71793f25", "indicator--4b38ba26-c092-419d-a30b-99394f785617", "indicator--f306f882-c918-4a19-b0c1-758e38e25312", "indicator--abbce5b6-3eaf-41d7-9e8d-39378a07b7c6", "indicator--698ab6fe-01e8-455e-9cd1-534671cc26c9", "indicator--d7367555-a863-4b7f-b02f-5368c51e3a15", "indicator--5554e558-c4a3-4396-abc4-94b6430c4232", "indicator--445ad131-6df5-4528-8ae1-f3a6e4c056e9", "indicator--91a985f0-160d-40e5-8f1f-50e4c2dbcc7a", "indicator--00fe555e-7780-4d4e-a625-ba60005c9234", "indicator--258aebae-92be-40b7-b7fd-ac4e4d6629df", "indicator--fcce8ab3-dc2b-4bdb-a2e4-d92429c4f369", "indicator--7703dfae-c63b-4e15-8e64-387d8716a3c9", "indicator--e141c707-cbcd-4f61-8ccf-131dcc72cc47", "indicator--41426ffd-5ac7-48f7-9b80-ac5f6de59212", "indicator--119abf12-3693-4287-a64a-2b84733a6b18", "indicator--e567e75a-8686-49a1-85ad-27d9d9321b30", "indicator--afcb6afa-1d48-4d6e-ab15-c337c5c2ca82", "indicator--e415b02e-b829-4272-aa76-e57d2705dd28", "indicator--aa9cd34e-f635-4e19-af91-984ef46e61cf", "indicator--a4189942-4ac6-4c15-ab7c-e1a427b51736", "indicator--229c42eb-2aa2-40a6-8142-a6003e51a4c3", "indicator--16cb137c-3f67-41ff-87e4-91c6a00906ff", "indicator--04a16b24-c87f-42ea-b7a3-c9e7d73300e4", "indicator--023a800a-a773-47a7-8481-def6e070027e", "indicator--e89d3336-1933-448b-a69a-7fe3271885c4", "indicator--47d4523d-be4b-4d6a-9ba1-0ff4ea145736", "indicator--5af188c9-853a-4227-aa6f-561799689aa2", "indicator--57d9ab52-8aff-4c12-a051-0c1b840a2ceb", "indicator--f18e4164-858f-42ac-95d6-d6c37d7726db", "indicator--66161ed0-01d7-4517-bf1f-b68a5ceaf006", "indicator--6d67681e-aeb6-4656-b56d-9aed82508312", "indicator--d5680db9-d241-463c-b6da-6ceb155aba64", "indicator--a7190eb2-9fb7-485a-990d-c05f28f16f51", "indicator--71b4b33d-3c1c-4933-a026-e31296530fb5", "indicator--ace3eac5-4553-4ce4-89c1-5b2e5e752b51", "indicator--9712d67e-9721-461e-a3f2-2ce5fd7cb421", "indicator--9ec4d630-ac6d-4c6f-88df-b20c3c848f88", "indicator--948d4b51-c735-4bed-bdb9-8b6ccd7bef28", "indicator--9bb83ee7-2f6e-4a35-bbfb-123ef5075139", "indicator--51757a27-99cf-48eb-9541-c3970031696d", "indicator--c065683c-3232-489d-a98b-c94f9c3ccd3c", "indicator--eef4abf8-6ca8-4253-bb6a-6bcc3a7ba4f7", "indicator--cb50461c-138f-4386-8dc5-01d1aba09e1c", "indicator--083e3334-dae8-46e2-8966-eb188950b5c4", "indicator--eba9a0da-a6df-4abc-bc86-0e4c173cf993", "indicator--2f6f9d3f-5b77-4c06-a1ef-e92a29eaa0e0", "indicator--351f360a-ea8f-47f8-a9c2-bf68836280d9", "indicator--569157d0-9b2c-4775-a8b9-8935628cb5de", "indicator--18073e8c-f50a-4253-b293-e1782feadb45", "indicator--0cb7ad2e-b57b-47a7-b532-81cd1012190f", "indicator--c59ea395-3341-4ade-8785-d78b38f3f39e", "indicator--9ba7eb71-5934-40b3-bf1b-824b5a6ba52b", "indicator--0f715c93-45df-4a1a-a69f-99b170bddd54", "indicator--f53b7ee0-2394-4662-93c8-48b1a7358eb2", "indicator--c87164f1-0f5e-4ff8-814c-6f46421cc5cd", "indicator--72cfeeaf-47a7-48e2-bb3f-8f16e06c89ff", "indicator--37bfb5ce-dd2a-4bd3-8225-bd9772c15671", "indicator--f33f2592-9247-47a9-86cb-4d80fff594c8", "indicator--27b4d59b-d74c-4e42-9e32-43bd04c12d95", "indicator--db32d76f-fe47-4855-b70c-99dbaacbd879", "indicator--b43c0fe9-7dc2-43b4-94d4-658d863f1f52", "indicator--38b9b0b6-75c0-4b1f-b88d-8b1042e7c005", "indicator--71dfaf13-d2d0-41b3-8181-17a463aebbf2", "indicator--e33f3cc3-d34d-4aad-925f-ba6efddf14a5", "indicator--8aa646f6-32d2-456d-a84d-e5bbb4364303", "indicator--bda201c7-9255-444a-8e5f-a18449173237", "indicator--85ce1e3c-516f-4354-a431-b01b73b347dc", "indicator--73557fbb-b0be-4ed0-87ae-fc9fbbd5c69a", "indicator--08d5e059-c658-4fa3-8119-2277cdcc3cb7", "indicator--e839bc71-4fc7-49f5-8a26-b8aff6b425d8", "indicator--0de7c142-7aba-46f9-8cad-4fa3d453f575", "indicator--2c97e9e0-64d9-4381-a0ce-a2b8a4e7242b", "indicator--ffe4111a-94df-4dbd-a455-fc933729ab1f", "indicator--24b8a35e-8926-4759-9de5-cbc65b5a7b17", "indicator--31b37a27-45fb-4e39-b78b-eccab634b27c", "indicator--0012bbe1-a5a7-4a04-ac60-1485c06a6e93", "indicator--61cec9b4-376a-4bd9-9235-057dbead7e87", "indicator--0decade4-23ed-4bb5-9c1a-b9f27eb7ad86", "indicator--2965667d-3dcb-467f-a949-8b7991dbf741", "indicator--15e36a76-87e5-4aa5-aaa1-523d3b3ca5db", "indicator--17f9d74a-2b2d-43cb-963d-018561eb02dc", "indicator--427c8bcf-f5a6-402d-bc2b-909fe8d08156", "indicator--e624285b-ab63-43ec-8e02-5d7bd695b268", "indicator--c8181b15-8987-4270-82ac-1ec1ba0e1c40", "indicator--0f84989b-faf5-48ba-8c7c-d60946ec3dab", "indicator--3e073a40-f960-48be-b4dc-8712a92b0f1f", "indicator--bada8cd2-6eb7-4d19-8ead-bc90f5e820a4", "indicator--bcd72caa-a482-4f3b-a427-8ec8382e988f", "indicator--9b6e7345-14a0-477e-bfb2-2c32dc67c83f", "indicator--4d17ddf9-7912-45d3-a6f5-643996f0ed4d", "indicator--5488260c-0cca-4082-bf58-55894d1c88a1", "indicator--eff16cd1-eac7-4d31-8536-ca8b15ca5f61", "indicator--1e4e025b-19af-49bf-a50a-e070497758f6", "indicator--a58aba91-a1f5-4e52-b8ac-cb8e6ecd69c1", "indicator--6ddd19fa-cce3-45f2-bf41-654b570c03c9", "indicator--1f13347a-207d-4c26-b986-f13e4339a7d1", "indicator--0a46f64a-dd46-407e-b8fc-baef6ea4db1a", "indicator--b2248ed3-3b99-4d47-a9c6-505655a22c48", "indicator--ccc8d631-c1b9-4c3e-9076-3cd84977f6d2", "indicator--884d893c-897d-4e7b-a586-b708cbdc5f70", "indicator--788f31af-4fac-41f4-b192-6ca862036c8b", "indicator--a496add7-78c9-476e-b28a-9db6724b576f", "indicator--b4171973-cf9c-44f5-924c-45059e9dbb2a", "indicator--d793f1dd-5268-4b86-9bcf-439cfb0a016d", "indicator--1537f061-2b10-40bb-9618-484ce452f2e7", "indicator--c7109b19-e081-491b-9e32-8400814f3938", "indicator--7fc5e88b-9fff-470e-ac62-71193f51b954", "indicator--716b1800-a5e8-40d2-8ffc-7898b671d613", "indicator--aa42718a-34c5-4cbf-a60b-48579d0cf5e2", "indicator--0933d634-95d6-49ea-8cae-360c19879560", "indicator--8fe2c895-e721-45ef-8b93-1c51fa41d44d", "indicator--3c47d565-63b2-4fe9-9f9e-2bb7af3724aa", "indicator--1a54924c-f1e9-41f7-8257-dfbb9c1a98c9", "indicator--1b73ba3d-ba69-4759-b22b-f9df2f9cece6", "indicator--e14e5b76-f995-4e64-9857-26a6c5482405", "indicator--767fb29b-931e-4dfe-8bda-8f4bd27d154b", "indicator--6be03840-2f5f-4999-bcdc-ff36b063b962", "indicator--c668bd71-8b1e-4b42-ab33-53b0cc1e87ee", "indicator--83c61999-8bf7-479f-bca9-234f811288e3", "indicator--8b32d6f5-7e4b-4755-8c36-3e0b92c56f4b", "indicator--e83b8de2-c02d-4a5d-ae62-2bed7df53300", "relationship--3af34d1c-ee99-46af-80b5-d37af7ecac80", "relationship--8a656e77-5945-452e-b9ae-ecc17f94bc90", "relationship--55df544f-efb8-4c39-afbc-aa99f852b3fb", "relationship--7e170778-128d-410e-964f-3f4f0ffbd212", "relationship--1db0c8ce-3f60-4e20-8cd2-859ca13f0b9d", "relationship--95f4290d-a3b5-440b-8053-e9351a194ca6", "indicator--eaed1383-1106-4670-9d62-3bd13ca4f757", "indicator--fe91eb11-efa8-45ec-95e0-ad8438d781c8", "relationship--59b2d164-ffd6-48ab-8735-daaab5127f4e", "relationship--f1d3c03e-b317-4233-b4c6-a9157ca2ee70", "relationship--de50a600-4e60-4d5d-a21e-b0f2a1479867", "relationship--4d001b8f-085a-4498-a247-1c6c42ba7523", "relationship--df260a87-02fa-4998-a7fc-77bf4925860a", "relationship--a198e5a5-8b70-4f94-a37f-c1c3a8837ac9", "relationship--4c4e2d4d-0765-423e-ab02-0297cca42eba", "relationship--dbb61a71-b12e-4221-b18a-f6bdd84e4e48", "relationship--6fdf45b2-9c01-4f14-a416-3400892b97c3", "relationship--e91076f0-39a2-4c67-84a9-f55d21fdd216", "relationship--2b8bded0-6ba3-4e21-afd6-ca63a0bd73c9", "relationship--0047dd7d-1bfa-4693-9991-a584165ee76d", "relationship--1474eb8b-bac3-4796-a5b7-89afef72ea54", "relationship--a1919932-ebf7-48b6-b830-1fa55917e596", "relationship--a1694fe0-4bde-4130-90b9-1a1fe2b4214e", "indicator--eb54fea6-fe6b-4e29-8c62-26cca4f3344f", "relationship--727ffac4-47c5-424f-b610-650a3fdf13d4", "indicator--f54d1687-4f37-4c5d-b430-5f72cfca47af", "indicator--11461990-b446-4c97-be70-12a0a7045f69", "indicator--5182423d-544a-4476-8fe5-5c8635388ed7", "indicator--ada6d8c3-f645-4595-a910-fe1a3b695e01", "indicator--4eb7ed49-55bf-433e-894d-f54bcc6b52db", "indicator--536c5b7a-5c42-49cc-9737-0ad6eb444141", "indicator--b3c53764-af93-4a78-a9ff-5263f174934c", "indicator--f31b9036-d42d-433b-a650-989a1c0f21da", "indicator--59c46837-4b0a-4160-92a1-1c5d551792cc", "indicator--0c57df7b-3e64-4f1a-bef0-7aedc3c2c3d2", "indicator--1d946aaf-00e0-42e7-9023-f328ef8c65eb", "indicator--759983a2-2dcf-47f6-9aeb-6ac4b5157653", "indicator--4c746ebf-41ea-46fe-a2fd-24698809a561", "indicator--6cad04f2-81ea-4b0d-a4d4-ec5b0df448a8", "indicator--39ab816e-c251-4e2f-84d9-11c86de20608", "indicator--d6fadee3-78c1-4766-b840-0461ab8292bc", "indicator--fb55e32e-a252-463f-b7b4-99b5eded6480", "indicator--ec47a20c-51e5-41e3-ae49-7db8c0b83450", "indicator--bc34c57e-27d1-4a5b-a64f-936b509f5e83", "indicator--96811212-8754-4bb1-818e-6bc57289a061", "indicator--06ca7c2d-9e22-40e4-8570-f04b7debf67d", "indicator--b1746985-b1da-498d-8385-d0d9ca90070f", "indicator--3efad483-e421-433c-85ed-fa19493f4fe8", "indicator--7c92dacc-89bc-4ef0-bf6b-85c73c17a051", "indicator--84275bf1-8920-4a63-bb2c-2916b943628e", "indicator--b8ae891d-00ea-4c92-b8ef-e1b6c357082d", "indicator--0b8789e0-f716-4652-877f-80616ff0ba37", "indicator--d21e5cf0-76ef-4e1b-83d0-149b5acf1d35", "indicator--5f0e9496-b29b-49f7-bf5b-b63e42167748", "indicator--5f34d2f4-c228-49b3-bf58-64fc16822e38", "indicator--a2d35fd5-d22d-4b96-96c6-88c6e60471a3", "indicator--4d2fe46d-4fbc-45dd-838d-5765c9f1f0e7", "indicator--0a9b30d3-f889-41a6-a0f6-29083c9d26f8", "indicator--c287f22d-d52b-49ad-99a4-073ac4d799bf", "indicator--540389cf-963b-4e01-ab02-b220e5b06550", "indicator--58b31b46-62f8-4fdc-9d22-a1350c754d29", "indicator--ca9b0290-6919-438b-a432-8241567af8e8", "indicator--a756ffe9-a153-4b48-bc0a-ceb600d1458b", "indicator--0f2f4d66-568d-4dec-8282-527d396ac824", "indicator--dd2ceb2b-0822-481a-8d94-9bc4bb34d967", "indicator--035af755-ae79-42a3-a00f-350d2234805f", "indicator--4f5f3b47-d1bf-4fa1-bbe3-da96e7a95bdd", "indicator--fe0b3c36-ff74-46fd-bdca-69bb0c488762", "indicator--0a7b4bac-e756-470f-99da-8f097d14280e", "indicator--67a7e5cd-f415-4b89-85f4-14f1ac26e7a3", "indicator--c6fbd801-d10e-424b-b7f7-6e3da5c73b3f", "indicator--7c64ee05-83e3-4bc5-88f5-ae51f0815158", "indicator--249adfcd-6f26-4494-8f6e-208cd68631a5", "indicator--ccf10506-aa2b-4bc3-a920-6010c38bcd62", "indicator--52c4d174-ec52-452c-b1ae-ec96f44eb9b4", "indicator--2c55006d-6429-489f-845e-f12310f9a9b4", "indicator--527218b6-c00f-4486-aae1-6f40820cb1be", "indicator--258dcf78-24ff-41c5-be59-3d77e01795b4", "indicator--48a92d33-fd6d-4cc3-9a7d-a3aae0f483e5", "indicator--fe4c6afd-dfb6-4329-9a05-9ff27d269626", "indicator--aa3232b6-fa64-4623-be8c-fc2bf3d7ea0e", "indicator--276ae3f1-21a4-4344-bb99-028b24530339", "indicator--683e0a31-feaa-47ea-ad29-6e48426d05f6", "indicator--6010e60a-e3ae-4146-aa99-71590e8784a0", "indicator--438f8c47-fb99-4a5e-9153-be5ef1113b2e", "indicator--831f7867-a3e3-458d-a2a1-982010580ad7", "indicator--1114071a-0ff4-4cc8-a305-3da8ff269a44", "indicator--201418ae-f162-4757-ab0b-99d359bd88bb", "indicator--2cba3c83-abef-4725-a3bf-cdb5b9eb13e2", "indicator--4feec7f7-11bc-4348-ad84-03b91fbe170f", "indicator--914e5032-0ef8-41cc-941c-893e32d1dd4d", "indicator--bc91dc04-7a5c-431c-9e39-25f3df9c71a2", "indicator--597076fd-7b7d-479d-9592-fd8417bd968e", "indicator--e817c11d-dc28-46e0-8b72-9c16229548bf", "indicator--9c793265-2942-4c11-b8d5-866fc178083e", "indicator--7580cb60-38c2-41af-84f8-a8d5c705d847", "indicator--1eb6673a-156e-4ce3-8787-2dbf31ad9846", "indicator--223758be-93c7-4ff6-b033-7ded1d59d9d3", "indicator--84147bfd-dadf-4ea3-ba89-4d5d2d3ebffc", "indicator--fbf8a615-159d-44eb-98c6-21e5d74aab06", "indicator--351de933-d96f-4e18-92fa-53dbff6fa94f", "indicator--af8f51b6-f224-40f5-ba8a-bbdffe0407bc", "indicator--04373af8-7faf-46c5-a826-0f0548d2d500", "indicator--5a93778d-add2-41d1-913f-27d3bb9e37e1", "indicator--b600d874-5cc6-4b48-9d99-b9b132742f5e", "indicator--1668d74a-46c2-4352-9f8b-f2cbd96828ae", "indicator--bf7f3744-f312-4099-a7f6-8769e1bf181a", "indicator--3d650657-a5d3-4378-8645-e4709f118de9", "indicator--04685df1-0df0-4d94-a7ab-4cc2337115eb", "indicator--ccb31349-5867-4fd7-85cb-734ce1a0c7df", "indicator--ee78c720-c869-4128-a611-bebcc6b563e2", "indicator--5afd7da6-c410-446a-8eae-c1d0e4890cb8", "indicator--7fefa0ca-c8d7-485e-a5c3-3b1376acffd4", "indicator--a7aa8251-5bb3-437d-8fbf-e03e89147937", "indicator--6310f636-4027-485f-931b-3be663361184", "indicator--d145a606-6cb8-40b9-8ed7-14009eceb0f7", "indicator--4daf6a7f-c95d-409b-8906-bedc7bba1c31", "indicator--42df4fb6-14a3-4a07-8a8e-d7140904ea44", "indicator--159e8456-2000-40f2-936b-75228b347ffd", "indicator--c7be099f-ae42-49a1-87e6-93cbbbab3911", "indicator--872651e4-2986-416a-ad9d-a63fb6f2c173", "indicator--e94ed29f-6eeb-4fe3-9d0e-f9412e135676", "indicator--1742640a-7205-44eb-a08f-dacb599a8948", "indicator--89940136-e85a-4d1a-a1da-cf969dfa0eb1", "indicator--2bafc678-eb69-48d0-b98f-ffde3226ff4b", "indicator--1cda2e48-deff-4987-b2a4-51aaa14a49c5", "indicator--3caa1dae-1a7a-4953-8798-63e6568f860e", "indicator--69f43ad1-da6e-4fe6-9097-ea5e32989603", "indicator--71d965bf-a0b5-4d2c-92f7-161a49cc3100", "indicator--18d71dd9-0fd1-43f0-8ab3-4eef4bde1822", "indicator--35b70df8-0f73-423a-99d3-8b6683964f01", "indicator--de2680d6-81f4-4b8f-a231-cc03bf4605ca", "indicator--779f0ee6-5813-431e-bc9a-26bdb1842ed1", "indicator--aa93d960-ac4a-409a-9c14-7d0e062327cc", "indicator--2b8ad393-9fb9-473a-8529-fdb2c9d37bed", "indicator--6c43ad79-3bf8-400e-982a-f902b2b2ee61", "indicator--a27c14d0-62a9-4a27-a4a9-a4fc593da091", "indicator--64363c0f-d1d5-4cde-b9da-03c5dfd09abb", "indicator--788afec9-f171-47e7-9457-925f6ea78254", "indicator--8df5c7bd-4638-44c6-8c0e-c4c6e1f3a5ca", "indicator--3f38faff-d990-4126-83e7-abc8eb6579fd", "indicator--25881b1b-4158-40a1-80b8-07a880a84afc", "indicator--238fa334-743b-4ce3-a6c1-2634d53b322d", "indicator--5f4f4b03-0e4c-445c-a2bc-a44169b81776", "relationship--9fddd136-17f5-43ba-b773-596f108bb513", "relationship--d2d2590d-4b60-4465-97ca-40f0be0d59ac", "relationship--8a74dba0-cf7d-44f6-9ced-79a38c86a220", "indicator--51757df8-96f4-4ae7-9731-e4b682459491", "indicator--3e2d100f-255d-406d-8bfe-6795648d7532", "indicator--efa89ba8-651d-4f1c-ba42-d0f59420627b", "indicator--9a736195-aee1-4306-992c-25e140f14d32", "indicator--d9535587-1ce6-4fff-aa38-a64446a48603", "indicator--5110064b-1bab-4a85-a0f7-7ca18bb8dc69", "indicator--c707ad15-7e76-4e0e-9169-fd6bcdf85d7e", "indicator--efd6550e-6fca-4171-a57d-b241cdd31e0c", "indicator--d13955a6-0499-42e5-bbd3-7a86578c46bc", "indicator--8c8a730d-61af-4f07-ab8e-9bf609cafe47", "relationship--b52e4499-f7a7-4551-84a6-68b5cfa8bf07", "indicator--d148ab19-7911-4446-9cdf-225675f37b53", "indicator--00e5af9c-ce42-4255-a7ff-78c671fcde3b", "indicator--8ce92044-c1ad-4795-9255-2cc0a5bd8539", "indicator--3429288e-a554-4d95-94d8-ad302afb68cb", "indicator--5107137e-0e41-436f-af60-43e1263cba52", "indicator--1172b593-2048-4382-9b54-707831a8a75c", "indicator--3402cb3e-5dd5-4459-8f64-6e431b8a395f", "indicator--3ae95d57-6ed3-40b8-be91-5a0746143c1d", "indicator--ff5e6a7e-e9dc-496a-b15d-85f219047829", "indicator--3b40a5bd-ff9d-48cb-ad07-d0ad5550331c", "indicator--152e5580-b9c1-46b2-bae8-771fc234e193", "indicator--16fb481d-2d22-4f69-aa5f-da2667831d3c", "indicator--1d36f9ec-5ac7-4ef5-95e5-5af81421e70c", "indicator--ed2baf29-01c0-4430-b8f3-1c68b531fda8", "indicator--5945e718-7ca6-4318-8d7d-a5039af3934f", "indicator--20c62f5f-4a2d-4b80-9d9c-9a06908cfb2a", "indicator--3bc2d8a6-376b-4595-acf5-561d06859ee1", "indicator--1de80741-289b-4f53-8191-c7fdb8bf29c0", "indicator--6f64481c-c0af-4f75-bcff-f1c86d45861e", "indicator--812adbe3-a6f5-4d05-a30a-1a01b599b931", "indicator--d10b1c06-9437-47e1-b002-6602347508b0", "indicator--f3fd8d5c-640b-4f48-b1f6-64a1716234b2", "indicator--01a57948-7f57-4fa1-90b3-2c0e656cba2c", "indicator--9ae44610-44b0-4667-9ae5-2733a8072e27", "indicator--d6047014-9978-4b92-a4a7-506d87691ef9", "indicator--1d812548-f3a2-4518-acf2-1ec7ba6a9542", "indicator--c7c6cbdf-eabc-40b4-aa5e-ff705133a6a2", "indicator--34151ebb-77c1-44b9-afdb-0253838d88bf", "indicator--43fb9aa7-0051-4224-a252-171300480fe5", "indicator--1faad29c-4a96-43e4-a6b9-aa41bddca3f8", "indicator--5d7d0959-07fa-46df-8ad1-c54b9d37a43f", "indicator--fd115209-a6e2-43d1-81f2-6b32a2ea068d", "indicator--f291f7fe-10f2-41c7-af16-15b39a42dd73", "indicator--b6ca5588-131c-4811-b89c-f1524a3d5843", "indicator--615c9c31-9365-4fa7-b952-e7ed996f9558", "indicator--2635a4a7-b7bf-40ec-979f-7a527e5dc61f", "indicator--8f7fb108-5ebc-444e-a150-907664da6724", "indicator--c573e781-e7cf-4944-b52a-28e6be347fa0", "indicator--5b11c3db-96dc-404f-99bb-48d55ce232c5", "indicator--4adc8126-4f19-498b-a775-1adc6ec0b6c3", "indicator--357f880a-b25b-477e-a417-7d280d6fc43e", "indicator--b669d077-e7fd-4943-999b-e0c11ffe888f", "indicator--a9e7e028-3732-42a3-abbb-17e65c42a646", "indicator--a3f21f27-7fe9-4ea9-b74d-d3b7831007c6", "indicator--abe208ee-f620-4251-8ba5-a8438b6e04d2", "indicator--3f91ed30-0f0e-453b-88ac-2bd91887b2c8", "indicator--f452fba9-89d1-4307-b0ec-a59f2395539a", "indicator--c97ff426-7cde-4cbe-8b97-4ee3dbf1f9a2", "indicator--8bb81007-83f5-48a0-b43e-52848c996f22", "indicator--53d2bdd5-1b70-4a21-8239-e5ee4d7562bd", "indicator--cd0bbd51-1655-4d3b-9a4f-f93cc3ad562e", "indicator--e36cf727-abc6-45cb-9207-973db4ba7601", "indicator--d6dae9f5-ac59-4875-bdfc-29b4d773645e", "indicator--897384c1-88ef-4469-abc6-1e9b7c9354f1", "indicator--ac6a1361-9147-4d8b-bcb2-ca6e55dc4f4b", "indicator--16c801aa-dba4-46f4-8215-0da6d1bb4e38", "indicator--af6ce598-bd24-4b4f-b282-b8d32fb4af4a", "indicator--e9d95150-fe5f-4f47-a8ec-dba79f0d7ec8", "indicator--fa95b6e3-6aa9-49e6-b96d-b8446733630a", "indicator--94b14061-864a-4740-a51c-43f8875a293a", "indicator--58fcc7cf-f372-45c8-8896-36a1d1715039", "indicator--cd980e59-a7f3-40d5-a759-dc1d777119be", "indicator--f95e5fab-107f-4fa8-bb17-53cfef4b2d69", "indicator--e936bf66-20b7-4559-aa84-20a7daa45cea", "indicator--253f31df-82ec-4b3b-915f-7d56c9a92a63", "indicator--677378ec-6166-4a46-beee-a9a5a6d747f5", "indicator--b80217f5-27ca-4a3d-9ae6-fba37df584db", "indicator--a6ada5e0-96f6-4564-b0e8-1ff47ec07d1c", "indicator--cce48714-c89d-44c3-8d87-8ba4c4721dd4", "indicator--8ea09ac6-1422-4c88-8e3f-99721e16dc85", "indicator--6e206a16-1722-454d-90a1-d12fd05eee2d", "indicator--571ab340-fcf0-445f-8901-2e451dd76866", "indicator--03776a10-0995-4459-840b-86d1d9c2d3b4", "indicator--d2c2aa12-fcc8-4566-b827-cde02b6b68af", "indicator--6e09b94e-96a9-49ab-9e5d-3cc4bef16369", "indicator--bd708cf0-1ead-4956-a215-82bf4d413e92", "indicator--0262051c-5f2e-4566-bbb6-7ec8bb679972", "indicator--ca5e9899-96b0-41f4-b5a0-70f46b9e096d", "indicator--a69294be-0f9d-42b9-802d-0a6f876ed299", "indicator--190d2729-e161-4307-b9dc-79f9d31a25e4", "indicator--166631d3-bc4c-483c-9a82-4547001a9a4c", "indicator--9f740bec-a3b9-4b39-871c-aaf641348a8d", "indicator--f49d8959-ef50-4e56-8f94-05a60cdd9c3f", "indicator--9895cff7-b0e9-4dda-aa7c-88692a805440", "indicator--7388a49f-e585-4062-a2e1-0730b15ddc72", "relationship--bd345b5d-fbb1-4a38-aa67-73cef424b615", "relationship--5a1295dc-5196-4555-ba9d-7db662dbe6e8", "relationship--06f5e973-9a3a-4335-a972-d2eec21001c3", "relationship--4eb985c0-6f0c-4c04-be31-935d7a33c4bc", "relationship--0ad550d7-790f-4ecb-ad0e-691ba08e7547", "relationship--006ba467-b21a-447c-b4e3-3db1e436ba28", "relationship--f24b0864-afd8-40b7-a080-c6c7aa7b0c7a", "relationship--cad65136-1089-43ba-8ad5-b509c19cf028", "relationship--67179689-d979-4887-bdf1-a199a12b6d72", "relationship--5786a106-d8dc-4518-8a73-d4e00d6101ca", "indicator--f0ed03e7-5916-47b6-bd68-c68a479c1f07", "indicator--ada3ec24-1327-424b-a798-85db53014354", "indicator--79ae51fb-76ee-487f-94ab-683c75d341ba", "indicator--8535bf61-f99b-4d8d-b360-c9318506aa0e", "indicator--970e5424-ccf4-4703-a4b3-82d23cfc049f", "indicator--342b5b36-40a7-4619-9cc7-75275daa5629", "indicator--a0a36b34-86ac-4816-9888-695feb868231", "indicator--14ecb896-57ef-4e39-be1f-29ceed2d5a69", "indicator--394da047-edd9-4f83-a7f1-2698f5621878", "indicator--1c4231f2-df58-4752-b3e0-9b24a2ecbbba", "indicator--4db1ffc2-c3d4-4a1c-8aca-f5b5302142e7", "indicator--3b8ccd31-cef0-42f7-93f9-6d9455fa552d", "indicator--6a2f6fda-871e-4c2e-ac06-7d10a7045102", "relationship--47a74931-419e-4de7-a4de-b3a924579cff", "relationship--4a8e6a47-6d82-4491-8c8a-9780e14a8e17", "relationship--887d7a60-a137-4056-bf35-3ba790cbf4cd", "indicator--8c3c1182-70fd-461b-88a2-26f83bc89015", "relationship--98ecc98e-cefd-47e4-a830-4a38d54d5edf", "relationship--8c6d4948-7575-49d9-bb6c-05d4035f5fe7", "indicator--8167b699-bb6b-4f98-8448-be8a0bb66b4a", "relationship--3a5032a1-68db-4cab-ba1f-33b265fe2949", "relationship--d0549cfe-de7c-4fdc-b834-aa0dc14b26fd", "indicator--83ae313c-1347-423d-a33c-0fc3b52d1b8e", "relationship--84ef92d5-62d7-433b-afa9-7e7b174d726d", "relationship--ee4d725e-a7eb-4000-a68c-cfd003375105", "indicator--0a54de28-f086-427d-bbf8-4f09566ad59d", "relationship--3fe1617e-ba36-4a97-844f-78ae04b8440f", "relationship--35805a8b-c58e-4721-92eb-92ef10c3c455", "relationship--3daacf16-82df-4207-9f7e-9e265111a496", "indicator--df14ec23-5cd9-4075-9c61-3fa5fb031da5", "relationship--120542fb-61a8-43fd-937d-b0142d8d6801", "relationship--18336566-2371-456d-bb26-818cf9509678", "indicator--724fb977-76e2-48ae-8d38-1c66910da790", "relationship--5e8c62f5-d869-409a-9fb6-f0b46ee6ff91", "relationship--f88d2657-e41f-4c0a-9102-b28cbc39dd2f", "indicator--164c8660-0e4b-419b-99ff-69e8c3cfd6cc", "relationship--5c84826e-e17c-4cdd-8170-16865ef2ebc1", "relationship--8afb2ae4-7e35-4c53-906a-02fee360d9e3", "relationship--6cb439ae-da53-4085-8f97-f34f750d5b0d", "relationship--e90ac865-995c-4768-b006-9ab0683655b3", "relationship--395acae4-df64-4ae8-94b8-79ec4ba0e9c5", "indicator--78eb99d3-479b-420c-a437-a94fd9541877", "indicator--ea39fd80-d94c-4db4-a66e-46e3a8d0c183", "indicator--aa16f88a-7b44-44fc-b403-dd634a7da965", "relationship--26b11764-d0b4-4ec4-b799-ffc36b626df6", "relationship--2c42dda4-e022-40d6-bf88-e693ab0f2c17", "relationship--d5e570e3-cd1c-42fc-a8f9-a95775637e21", "relationship--34548ecb-ea79-4186-bd08-c48e58e73ce4", "indicator--cd9a0195-7300-4bfa-9cf3-d1c3f5dc5cb2", "indicator--e222893d-16c0-4415-959c-57149f5e8222", "relationship--0e13c113-1495-4637-b43b-26f29adf7bc8", "relationship--6647d5ee-1c4a-4f3a-83e1-0169639a39f5", "relationship--a0c6c376-6de7-4e91-a0ba-228e64dcad3d", "relationship--30cd7f73-78c6-412f-a712-3a7b1c8f2219", "relationship--10ead337-a7cf-4203-baa8-72436b4451f5", "indicator--cd0e3ff3-68f5-44d9-822c-a1ec44b61e72", "indicator--64991e9f-a450-4ed8-98d8-1d139a0a470a", "relationship--71157efb-8607-4e19-bd4e-09358cbd5cc0", "relationship--8e1bb6fb-c949-44ec-8ab0-f3b0a2130e5d", "indicator--246cb5d3-9114-4c11-b7a5-0a24df039af1", "indicator--4a906e25-3667-401d-9549-547e782b2e43", "indicator--759a1240-9a9f-48ee-8c4d-309e945ea6a3", "indicator--e4519d69-6f74-4ffa-8b74-23ef9a41e21a", "indicator--3fe7de4b-3914-471a-8051-dbc558203f6a", "indicator--29cda941-e907-4562-92d7-48b70fb674f1", "relationship--b4330f2c-d328-4406-b8f0-46496c68bb00", "relationship--8cffeaff-ecbc-4da2-a904-b3d1628c3da5", "indicator--3501d0a8-e652-4957-8c89-36b68c3d9136", "relationship--e9427a43-5c11-490e-b126-053fb430f162", "relationship--5630c74f-adbc-4dc1-9718-34d9d655d855", "indicator--2bd3e8ce-d087-486d-ae56-ae387f593931", "indicator--b22b100d-5b04-4626-a56b-1ee5c0f99a38", "relationship--52b63fa1-524d-493a-ba41-f2ba67cd5c81", "relationship--0d81868d-b8fe-47d1-9c6d-2ef3100bba64", "relationship--68529636-2be3-4357-8a54-06867c8d7955", "relationship--fa858083-5633-4c4f-bc4b-2a371b96a99c", "relationship--304c0482-e26f-4428-b6ef-2cb2ef342334", "indicator--9066a148-6ec1-451f-a337-0cc2e669ef0a", "relationship--de640421-b503-4bbe-a3df-7ece18ae80e7", "relationship--4e4b4e7c-ff34-479c-8a56-044f913f701e", "relationship--90f781ae-e143-4816-9fd6-d1c8e52f99fb", "relationship--4c01d9fe-a95f-459c-8514-a1791c3ca846", "relationship--ef6ae754-21c1-4601-9400-fd4f6628a1a8", "indicator--b16c96bc-f692-4183-bbc5-0768b5bb59f3", "relationship--eccfdcc5-0f82-444c-b42c-f900b7def6f1", "relationship--4507b39d-5811-4346-aa62-81c98acbcb61", "relationship--d5a1a191-c533-4b14-8412-c0acc7c4b0d6", "relationship--1fd8523d-3514-461d-b0aa-40ea75ba6b6a", "indicator--98662a19-dd99-4d15-bb34-969ecd8a5d53", "indicator--d53db206-d3c3-44be-8e40-aca73c262ddb", "relationship--07a1bf74-16cc-4711-ab20-a58315c71e7a", "relationship--bb8d1d3e-ee0e-455f-a00b-7940c1872df9", "relationship--d2395456-77a8-4c85-8adf-af2b302d3fb9", "relationship--b3787bee-572a-4013-b713-a05bc7b5fd45", "relationship--b983741c-f140-4d63-993e-e30d5f61a35a", "indicator--26786ed1-8a09-4dd5-a2b7-3cff98280e30", "indicator--27a535ef-62d2-4353-ae32-a28c1da1594f", "indicator--0da64d65-1329-4402-86d8-daba417204d0", "relationship--ef0f2161-51c3-40aa-8750-dd1ca925adb6", "relationship--87a6694e-d1e0-4844-b26b-531f1ef08b82", "relationship--2afc2a38-1aff-4994-ac56-a26073848000", "relationship--7f7deed8-a63a-4bd2-a035-57dc784748b9", "relationship--abb298b4-56fe-4a24-845f-f25f487f159c", "indicator--7cd3cf7c-569b-41bd-90fd-ef576b05077d", "indicator--e54034ac-6119-4891-ae7e-b466265e56bd", "indicator--52a7ab71-9826-4cdd-b1cc-a421db6b0079", "indicator--a96cb52c-a9ac-4023-92a7-69316b00874f", "relationship--92bbe02c-a046-4020-8239-c3b0a9076f65", "relationship--beca9474-ee66-4d1a-97cb-668fd5a0716d", "indicator--a2ddc428-7d0a-40f4-b623-70322ac91d52", "relationship--11115ee4-ff77-471e-b7c3-d6f5e3a9cae3", "relationship--1fb3b608-c4ec-4d21-a2ab-a444e2354ee8", "relationship--426d868a-5d80-49b8-9bc0-9936ca4d7dfd", "relationship--e132a56b-46b2-4590-971b-e52925edd7b4", "indicator--cec26d8a-1e1b-434c-b505-b1330d1c39b9", "relationship--4fdf532a-cff5-41f3-8e71-db9bae9cf60a", "relationship--be7b6099-da0a-4c51-a390-922342b0f174", "relationship--4fb8646e-b18f-48a0-b4be-12a2561fef8e", "relationship--1a19d263-c853-4e56-bc6d-e11d5c22f83d", "indicator--ad088c7b-2053-4c78-a687-361b47aec2e6", "relationship--39c552a6-49b1-42ce-9131-d54d99715769", "relationship--e79b2d8a-63b4-47f6-8b54-2c8bbc7667c3", "relationship--e07e4606-50fa-4716-809d-4e37890b1947", "relationship--db5134c9-ea4c-424c-867d-1d00ee3d1a0d", "indicator--09952396-fe23-47eb-a743-c257776cb68f", "relationship--4f212539-6bf1-455e-b869-0093eb1c8626", "relationship--e138d133-dfed-4291-9e9a-3b7f91d1ebc0", "relationship--149af721-bf2a-4e72-b405-ce14f734013c", "relationship--4b4662f1-1437-4c25-8786-00fde096d6ea", "indicator--6d1f8b60-c6e0-4c3a-8a98-e926d3f0ad18", "relationship--c0f14877-caf3-410f-97c2-287cf37aa951", "relationship--af23642b-f68e-4fe7-9754-424f71c88f59", "relationship--c850e159-1479-4fb4-981b-7b154a1a95d9", "relationship--2768d99a-9888-4ba7-aad8-e8c71e73edc4", "indicator--f7ea7d7c-fe40-42d4-bf34-2bd04f542244", "indicator--8239d987-fe3b-47f0-88f7-5a7e41a232ca", "relationship--2bc472b7-b586-48a4-8133-39ecbd31fd47", "relationship--8797da3f-d65d-4bde-8b42-c8da88531516", "relationship--344c33ea-4ec2-412e-bde6-f8a07c58b9f4", "relationship--772da098-ce3e-4a35-8c28-e0e07931f34a", "relationship--d969bf57-ecef-4f1e-bf18-fc2476abb51e", "indicator--a4ac20de-8612-4a8a-bc3a-a786dc127e1e", "relationship--7275412f-1d4f-4424-aebf-742964d33287", "relationship--7386a75d-4f84-4457-bff5-e452db3c8e03", "indicator--19a57c48-2d64-4e93-b7f1-60b11d7599e9", "indicator--a8b43332-f635-432b-ad1e-5432fe763ac7", "relationship--fad31377-4b34-410b-9a33-60337f3ed78c", "relationship--2f2fd57c-17fa-43ec-9225-7f51249fab59", "indicator--2a7ca733-698c-4784-981d-9e64f9691e98", "indicator--a6fb4ec9-c401-49d0-8018-4fa2d3a1ef7e", "indicator--86bb8ead-8f81-49ba-949e-14cb424fb483", "indicator--2c0a6334-af76-420b-8ae9-a47146ea86eb", "indicator--c8fb2fe2-5d29-483b-a618-69dcbd588e73", "indicator--3df1eab7-a2cb-4df2-9eed-5d7c1d94ef53", "indicator--b8a57676-1cd4-46ff-891e-6d75c5cd38e4", "indicator--88b9684f-7ce4-40b6-8cdf-8f421bb2180b", "indicator--0b0650a4-53c2-48f3-8cba-414cf5f4b6f5", "indicator--38c5c399-1452-4c53-b886-64fee9172c7a", "indicator--04f1669a-cedb-4afe-b1a5-b44cb4a3d8e7", "indicator--e3b7b595-7038-4ea7-9c25-1c943b8d58d0", "indicator--15393fc3-731c-4a7c-b397-0d5e63620d86", "indicator--5486f46d-9d07-4b51-ab4f-41fb45742cf8", "indicator--562a81d6-7673-48e2-b122-5de7e29ba8fb", "indicator--2afacc4f-25ec-43dc-86e3-0c2a59991611", "indicator--ae6aff00-8ac6-4a66-a72d-592ae9ebdc1f", "indicator--7aec10dd-e9d3-46f4-bc1b-2a4b661a121f", "indicator--1640d3a1-35a0-4084-96f0-d3b351f09c82", "indicator--ccfa4205-89cd-4224-975d-6f266fa452ef", "indicator--cc2b832f-aed9-4bfb-a4c2-f6f729a7fba7", "indicator--b21897d4-e300-4942-99ee-134c0ba2305c", "indicator--7a4771d0-519f-4650-bff4-09e37e82bd7b", "indicator--1a6834f4-eae7-4900-bcb3-2638bdb6a1ea", "indicator--e68e59fa-a02e-438a-9402-8f1a602a572a", "indicator--097791db-3cac-46ab-94b1-f8350f9d6b7e", "indicator--0b25bf8e-7b64-4e84-9d66-b6f97ab2ef09", "indicator--eeae4180-9160-47ca-ac82-7fe15dac0614", "indicator--5958a761-a22d-4da1-bd80-d4403cbd8a15", "indicator--8ca93bc4-5a41-45be-8fc2-1003b8922c34", "indicator--67661070-7006-45df-bd84-260cb7e05f90", "indicator--ac1d495b-c14a-4f97-a971-8be770a52a87", "indicator--c9bd0ecf-9171-425e-afe2-b9a2cc041c39", "indicator--9d3243f6-c1d6-4ec0-a7ce-f36666e4a69b", "indicator--d5ea3724-09e4-4ef5-8b7f-9e66754076a8", "indicator--44621493-b8dc-462a-8f4e-89f1869ef30c", "indicator--81a22ed6-2876-49cc-9b5f-53b2d7184427", "indicator--36391f3e-9610-4cf5-82a4-6442b9edf09c", "indicator--8c78ba85-ec48-446e-ad71-e2f44395ce54", "indicator--23164220-cecd-40c1-ad75-a87838e98270", "indicator--2ab1a440-de62-4933-8422-55ade0218147", "relationship--48eeb566-7ece-46ef-8759-3a70add3a9f8", "relationship--ff5512df-adfa-431e-b741-21aa1ad6e6e8", "indicator--e4bbaf4d-d282-4831-9067-397fea4f8af5", "indicator--e78453f6-874a-4b28-b7a3-a0f849cb5d64", "indicator--f1a85567-5d36-4c53-9c84-3324f97a3ff0", "indicator--0e772c69-0a4b-4a66-a881-7595d824f5f0", "indicator--5c0efa6e-4f70-420d-aa97-e0175199e4d2", "indicator--ec5bd722-76be-435d-96d1-5832476814e0", "indicator--4ddf2e1d-6ad0-498c-a4c2-1aa2c398ab10", "indicator--a703065d-3ad4-4778-b274-2cf57a81cd2b", "indicator--137f76c5-c4de-4fcd-a26d-6148304ff097", "relationship--0b8883c4-47c3-4a2a-a9e5-304efc70dfdf", "relationship--7bc6e327-0392-4cf2-9c54-812313554cb4", "relationship--2993c3ef-45d3-431b-ae20-4f8e7118f501", "indicator--b501c71d-54ff-4db3-b4e2-271128831635", "indicator--4834bd65-8b43-4237-9ba3-80666a987dca", "indicator--e19de7d7-776c-4fc2-a503-00bfe0124914", "indicator--def3432f-5aba-4586-8c1b-91057ba0439d", "indicator--db152f04-abed-4341-bb9c-4bc20e8b1a82", "indicator--f5f9bce2-3aab-4ee7-a373-ab2e0788f329", "indicator--8354f740-6ffc-4a10-9398-f16db67f7f30", "indicator--7e099565-8b3e-4a60-8373-78e29f6e1ff6", "indicator--f95b3855-d991-4601-be5a-04444bea8b71", "indicator--5373b6aa-72a8-4e8f-8f70-d51a90ac25d2", "indicator--46088861-21c2-45ad-8ca1-f49f24027d99", "indicator--fa5d92e9-5ac9-4524-82c7-4d38b6603af4", "indicator--0cfe2acf-5494-47f6-9eca-bdd7e4d1f4d9", "indicator--74ee07d7-7756-498a-a850-0da6f41ab439", "indicator--f2e48272-61e8-4ec6-8177-f07186b283b1", "indicator--4ec0254b-4462-4aa7-b6d7-c6950a6d7b96", "indicator--30de864d-c4b3-4c51-847a-347bfbd5e7a9", "indicator--afe81ed4-13f5-4586-a745-791249059e9c", "indicator--96e8e721-ce07-41df-a720-5885a921f145", "indicator--35ffef25-97cb-4f97-9f14-b3bd2306e4c9", "indicator--34ecf09b-4c11-4d0c-9d6d-5656c3d8c82c", "indicator--1d1192f9-24ca-4290-8e2e-d27022cb85a9", "indicator--4217202a-d9bf-46ce-9ab8-b1b05abc96e6", "indicator--3d602c3e-2947-4a81-abb5-3c0e457df5ba", "indicator--40c37842-7f55-40bb-982c-df4462dcfc50", "indicator--97fe5cf0-443e-48ca-9176-89d3073b8e3c", "indicator--87c2d3bc-0526-462c-9991-88e9c76c9e88", "indicator--4d6cf95a-1805-444e-aace-958254a83cbb", "indicator--9d574693-84a6-4265-a2af-c88196cee675", "indicator--905bb737-395a-4bfa-a192-d4247d807b25", "indicator--46ceef33-74e1-47a3-be65-867e19b09764", "relationship--7fb9c988-6092-4c54-8567-8d70e73c4672", "relationship--0f3cc568-630e-4242-885c-27cc3f6d1e55", "indicator--7c2d9676-9969-429e-9c91-eaf5c2123fda", "indicator--61d9d3cd-9eb0-43c8-9c21-37b7eb89cfd2", "indicator--4425f531-ff6b-41b8-bea9-250a404fe7dc", "indicator--717ff8f5-138b-4581-aca8-a53507ba9f8d", "indicator--ac875c58-4cc6-4b3d-9457-5287fc820ac0", "indicator--02c2c5b2-5d2e-4c21-b79c-42bac60a1de0", "indicator--4feda227-63f4-42cb-bc86-091a1e3f6d13", "indicator--2dfd8279-f030-4888-af0a-d0ede843b7b9", "indicator--b70eb3f4-67cb-4881-a880-bc49bf9955d2", "indicator--0186039b-4d8c-441d-aef0-e935d83d061a", "indicator--089a93eb-7ebe-4120-b2de-cfd77b03b345", "indicator--265a4e64-e6d0-4d50-a42f-02eb1ad5fb1f", "indicator--c489bfec-b949-48e9-b60f-58fc7aa1e71d", "indicator--950f571c-3f69-4ef5-90f7-64d0a75603e2", "indicator--4499cc03-4d9f-407c-b0f8-d8250162cd4c", "indicator--0c061c50-06b9-491c-8964-7ddc7f3035da", "indicator--52ca2bb8-3dbd-4a8f-9903-035c41529996", "indicator--0eed15f7-74b1-47ac-bf62-d5c985cee7bb", "indicator--ac4fe748-03b7-4997-8037-7a0922c4daa3", "indicator--b5ee3209-ffe2-4980-9c58-09a36fb246e5", "indicator--dae80c12-9002-413f-9b3b-de9b7301f358", "indicator--99cdde50-6f21-4043-a6cf-025dc217dbb3", "indicator--783b7eb3-dc4c-4a86-bd41-2fb828ea2120", "indicator--30e5fe3f-5263-455d-887c-43f03f7a36dd", "indicator--b1213282-4682-447e-ab28-69a9621dcde0", "indicator--062dcc06-09e8-4e9b-8ce3-2ed1369c8a6a", "indicator--830e8ec2-34fe-476b-a392-05057628e8d6", "indicator--2e2bf181-cc6e-43f9-a711-c00b3bbf4322", "indicator--b743f314-bb3e-441c-8170-fe9883ef30c8", "indicator--64d198e5-a02c-4158-8715-4cad43a3595c", "indicator--c97a0c3b-56e1-4c09-8b8a-036cc153588e", "indicator--0e71bf9c-7970-42d6-b6b4-a75f25246427", "indicator--9758529d-bda6-47d8-9e93-5f3125265761", "indicator--2b9ba97c-1259-453c-9903-053d8debde6c", "indicator--732005cf-380f-4737-8c83-57410e010aa5", "indicator--487b2515-339d-4892-a46c-afe265b8f9dc", "indicator--32f0469b-1d8b-403b-bf8e-7129a3305e57", "indicator--d8d04443-e2a2-4499-b159-b4cf0c39c896", "indicator--d5bb48df-aea2-4a17-be82-6e29f89a8f9b", "indicator--44766863-c330-4f33-b9a8-3281c1fed27b", "indicator--68a099f7-2ae7-4141-a44a-e088021e2479", "indicator--a82e5ba3-2ce1-4ef9-b001-2fb5b298a7cb", "indicator--225d9218-d4c5-4f5c-9307-4c6d7f9a06c1", "indicator--0f0e54d4-4624-40fd-99d0-a7933c6dc8e8", "indicator--13fadb42-ff78-4fcc-9bc9-fbd759d25950", "indicator--8ac46dec-1efc-4314-a6bd-e54ffd61b7a0", "indicator--06db1016-2ba7-4f4e-ad0c-094983febb7c", "indicator--f3f96baa-dc2d-40a4-b929-ab84ed52689b", "indicator--bfa1a702-301d-4a8f-ad00-f76ced7f7be9", "indicator--1798cd3c-8b23-4c2c-8ad7-6749a4c3b067", "indicator--3a18b4f6-465c-4ad2-85cc-93f65623a91c", "indicator--35ecff25-8425-45d3-9882-d86836ae3a64", "indicator--fa80a60c-3fb8-4eff-85c5-008f63845277", "indicator--6da31b62-03b9-4f98-8a12-83695f823be5", "indicator--20851a2c-3bc1-4b65-beac-15c595c27d59", "indicator--51c6c0f8-4637-4e0d-98fd-4ed698db19c2", "indicator--77ed316a-203a-42f7-97b8-c874958e151f", "indicator--a5be6849-619d-483d-8a4c-495d2d080c6f", "indicator--8fbf6ec4-21c4-4317-b8d3-14ea6c3c85be", "indicator--e66f17c8-72e3-45bc-8805-d08ec74283fd", "indicator--ee351ca7-8613-4a06-9906-1904d8b85398", "indicator--b534dae4-6175-43a1-9397-7f6561c11877", "indicator--0601d210-d5bd-4688-be6c-4e3b9150646e", "indicator--a27ab0f4-0c12-49bd-9d4a-fbbf89235b4c", "indicator--4cb068ed-1173-44ff-8705-58cea4ed8568", "indicator--f96a7052-082e-4944-b4b9-88434f2edc86", "indicator--e984f3f6-2fb5-4523-97b9-e27d45a18398", "indicator--52e5636a-3573-4123-aa4e-fb1c9c648696", "indicator--36d0fe63-d244-432b-99fc-05d96a8fffd8", "indicator--a03fb8a5-47af-4cbe-b1b4-a3b92bc4520e", "indicator--61da5585-c400-401c-b59b-f9e3b037ac57", "indicator--18c5b578-7ac1-4e08-8de1-7414104d86ff", "indicator--ab586679-ac8d-4e44-b3b3-7f2df7b23651", "indicator--3e623e69-60a2-4656-a670-05a6770ab1fc", "indicator--747ecce4-6ac7-4bde-9abd-f12ece2e0ab5", "indicator--6ded691d-6f75-474f-8f6b-9998bce60f94", "indicator--61a7865b-e0dd-4564-a1d5-26a6d86f2f5f", "indicator--832521c4-c4db-4579-be20-d4fec49630cf", "indicator--83ad81ac-82a3-49d5-b8dc-0de04412ad03", "indicator--9d712f43-fab8-4536-be2f-207546690680", "indicator--d0a3ba45-47de-48af-be7a-8766449ced0d", "indicator--49f25bef-a50c-4b83-a3d4-dff50d51bd95", "indicator--d770c335-ee98-4a3a-a910-0942fc6960a0", "indicator--8d56ca6e-313a-454a-a656-908ff5dfb06a", "indicator--c6231e71-3849-475a-b4e1-ff0bce5345d5", "indicator--db7ed5e1-3e73-4077-8263-f1b1b7960f7a", "indicator--21924000-e2ab-4c27-90c2-221ff8b636ec", "indicator--a7219b81-35a5-4b25-ac6c-f5eef52741f0", "indicator--354dae42-e2aa-4bdc-84db-d42fae223a81", "indicator--88df1f4d-813a-42d5-9ac2-132a06efd000", "indicator--b166b69a-e141-4d31-b37e-e5f991b14a75", "indicator--e7a34a23-5129-45ac-b797-d38f012146ee", "indicator--0640eaa8-9b02-44f0-95d5-d9b922131422", "indicator--9169b4b6-513a-4131-a563-4dc8d2d6728d", "indicator--5846adf4-de4d-4549-97ba-cb7f8ee0ecec", "indicator--6ec20d59-73b6-4226-b7ea-f1d3190d2a69", "indicator--a27cb341-5dd3-4218-a156-5820fee92534", "indicator--9939bfa2-f42a-4457-8c32-18c6f4faad67", "indicator--0955a836-4f42-44fa-8c8e-9f018dec7290", "indicator--716b82c9-fcb2-4d98-b9c5-4412e2daf38f", "indicator--8b2bff80-6172-4465-9521-bc1295786907", "indicator--cd9ef2db-abe2-41ce-bf52-9413a89429b5", "indicator--73473477-c01f-45e6-8ef0-c2a3e5b0a1e3", "indicator--32ee435a-d3a2-4242-98a2-e8388c0fd0ef", "indicator--68ae37f3-a9ad-4c44-8a5c-05d204f92111", "indicator--60f6532a-d796-48d3-a2ed-ee8725d666eb", "indicator--2da1c6e9-7cf5-4b60-9835-2d474b4d1289", "indicator--d604ea2e-9c81-42e7-852c-095892682fcb", "indicator--c07d9cbd-c5f3-4e30-90a6-1cea8de1adef", "indicator--16178bb0-34d9-4daf-8671-02766129fee8", "indicator--971264fb-326d-4425-aac4-bc6b35edf437", "indicator--f0fa2a2b-fdfa-45d7-a7fe-0d602c8e5e65", "indicator--7fe701b6-a9bc-4b45-adac-ddd109d9ad21", "indicator--2c0ae264-9278-43a7-ba07-3db4829876c6", "indicator--fd7d91b5-236a-4d43-af07-a4d9e5bee945", "indicator--a63cb6ad-23d0-4207-a492-68966306ec85", "indicator--313ee934-2561-418d-9606-62d3c3a75046", "indicator--837b2ac0-dc9e-4c05-aaf3-4f93d44eb700", "indicator--c269f442-6d14-4cfa-a7e7-34dbf59a7691", "indicator--ab895138-0ec5-4af8-9367-0df42a745836", "indicator--e84ebf5e-cc2c-4b9e-810e-96c5a385afde", "indicator--ec93cbd2-cbee-4661-80ca-adbf46b3063d", "indicator--b4837696-8ac5-4159-9a37-3e76bdff17a4", "indicator--6734a680-ab70-43c9-a6d9-d701de5f1c3f", "indicator--c744fd9f-8d4a-4c9c-b8e0-6658b1b76d81", "indicator--eadf7b43-0afd-4be8-a66d-a4996813ecdb", "indicator--c7691fea-4d16-46df-a529-817f3a907532", "indicator--b5df9c13-0ee9-4dfe-9ac9-fb6f5013595e", "indicator--d2ae81ab-0dee-4ad3-bdb1-c19c3ed4700f", "indicator--e9f1e85e-4513-4df3-bf5e-cc89b6d24120", "indicator--3a2becc6-a9eb-43c8-ac31-a9e62095bfa2", "indicator--f41cf0d0-5893-42b5-8ae1-cb7a606088c6", "indicator--d553a5d3-e382-49c9-a736-7d5bb7296d17", "indicator--82e1e4bc-5b39-4ea0-b077-525978dc51b1", "indicator--21e04da8-2624-4edf-9ef5-3d9f35235de3", "indicator--2a805de7-dfd1-40e8-b10d-93d510a82088", "indicator--3da1b2e5-fe63-49e3-b34f-3df3a657ccd2", "indicator--151ac0e1-671c-44bb-975d-25d62b446bd9", "indicator--64ff00f4-fb1f-488f-9cf4-65fc245d69a2", "indicator--bdb0fd34-e0a4-48b5-97ef-b245b516da95", "indicator--75164a2a-0e8a-44b2-a63a-66fc1118d9f9", "indicator--3fec2bd0-63d2-409f-9053-c40242ffb3d5", "indicator--fb363c01-db29-40f3-9e9c-c0eab16dc116", "indicator--2fed7340-c630-4ae2-833e-67f36f454879", "indicator--a00b7a33-7686-45ef-a095-03fab410d033", "indicator--42b929d8-c8b8-49b4-9a52-fcc5786d91eb", "indicator--5e198c08-70bc-43ab-b937-0d12f3972595", "indicator--4a6e8380-6312-4d56-b5d2-6b068bbbe1e2", "indicator--af4b7001-8943-4607-a679-4ed4fefb0a19", "indicator--af08f576-a9f5-49c6-860c-832c9c1aa8d0", "indicator--2a389967-69f3-4873-9723-ba6cf8000f18", "indicator--5f908b8b-f0ce-4142-93d0-dd3a3e5dfc82", "indicator--ef8e506c-43f5-4918-a70e-062a7ce60b60", "indicator--dafb9c3e-2063-454b-a6df-408633bf0089", "indicator--7baabb12-6d22-43f8-a086-8782031f1159", "indicator--8626e9f4-91e9-440d-a30d-10ae763018b9", "indicator--cd6ca815-37ac-4b1c-bbe0-1bb2851fdf13", "indicator--52d318bc-2d54-4dd1-aa44-e7a92713674a", "indicator--ff5aedf0-b0ab-4629-a0e9-38503994dd35", "indicator--b64d562c-2146-45fe-ace0-3ca09aeb64b9", "indicator--ae3b8db5-881e-4a77-9869-a21137bda1c6", "indicator--d5a82f56-6b94-46ac-aa5e-d45d6418fd0e", "indicator--0b09b65f-dd09-4e0c-a2d3-2879d60f1f3b", "indicator--9401cab4-a35f-450d-81eb-0cfe5516855f", "indicator--d63c147b-96d7-4def-a3e5-47c95192d761", "indicator--daa1e77d-2388-49c9-a437-d0819d6dad95", "indicator--09db0f4b-6d40-4f72-97eb-87b3c0dd1ab9", "indicator--c885a890-4261-4544-bd6c-5d7914452934", "indicator--ba32b411-3dea-43d6-aed6-abefe4e74aa3", "indicator--ad6b4adf-f727-43ef-b389-08e061f261ea", "indicator--db8a0827-c3ca-4137-be4f-711d02421294", "indicator--c02da756-f264-4ef6-aa10-cf99e9f74af1", "indicator--95a368d5-9b22-4dae-93c4-c3499ece4bc5", "indicator--fd698f40-b5f2-4f0b-93e9-2416175b8269", "indicator--45cb37e0-097f-40b1-a472-53a9c60eb0a5", "indicator--e930d3e0-fee3-4bb2-914d-e8e329b0ed90", "indicator--b4efd149-372f-402d-80b4-0c9b01dda5cd", "indicator--75fde9f9-b9ad-4ce0-8dce-b0d24ee9acc4", "indicator--cb2212e5-1dbc-4c8c-9c6d-5b524fc423f4", "indicator--fdadb15e-a093-4196-824f-fd619e2643e6", "indicator--25509ee8-fe30-45cf-8d4a-8cf7cc9c21cb", "indicator--98ce05b2-4fbe-4b06-be7a-dae0c789fe20", "indicator--804eca06-ee46-4900-8e61-0cf0ea3a79eb", "indicator--45de40c8-653a-42fc-82d7-2958813a4d16", "indicator--4dee0fe8-0b48-4345-865a-5abcf15319a4", "indicator--3af6ba5d-7af5-49c5-a2bf-2aefdc377793", "indicator--b8afd7a8-9572-4096-af53-207238ce24dd", "indicator--a5f7a4b4-5034-414d-842e-aa33dda3fc81", "indicator--861f47fe-3f80-4e17-adbf-d2bfd69195a6", "indicator--232d8d61-ed74-4e03-a97b-33f03cf6a1de", "indicator--6a2c49fc-8331-4957-9e8c-88b0a2a66de9", "indicator--29ef88d2-44da-4827-9c9d-40ae1a20717a", "indicator--38321145-d55e-4995-ba79-e161b34ec32a", "indicator--8169408d-9a61-455b-9f7e-9913f2a58ee1", "indicator--807f9f7d-0ea0-4d4b-9c57-ced01cfab974", "indicator--fb457dba-f851-4601-bdc4-f5fd36d8ba76", "indicator--fbfa775d-f2da-44d3-bd20-b18d95adf06f", "indicator--7c094f6f-12a5-4141-a928-017ff6a36235", "indicator--260082a4-c105-4913-a24c-4c69353151af", "indicator--b04b29f8-d6b2-4678-9722-acf3f6e687ca", "indicator--526e1529-4ea3-45c7-9798-117cafafa052", "indicator--599a3292-40ad-4530-a4cc-2f5bf28b264b", "indicator--0f51ae45-85b5-46ab-9040-42dcc8db3905", "indicator--0092e796-d938-4a65-a84f-2d784fb1562e", "indicator--f8a38c04-0c11-4375-99cc-f3062ce5edf6", "indicator--5a8405c4-af90-4b31-a29b-a548a7109a36", "indicator--3c977841-a0da-49ad-89ae-13805604422c", "indicator--7c72c54a-8d41-4dee-8185-230093632779", "indicator--c862dedb-941f-4899-ba0a-18d2bef95aee", "indicator--2ebe4db0-6ce6-4259-8c51-b57f11045dbd", "indicator--6b4f34f3-2118-4c9b-8c3b-18e7e4718052", "indicator--884075a2-37fe-4151-8440-24e4ef499987", "indicator--481804cd-31a6-48fc-ad79-342abd810269", "indicator--d22aa8ff-f3d3-44a0-82e1-2199d426e0a0", "indicator--8d2dd905-90f4-45cb-97e2-8efbfb898992", "indicator--c4b8d922-bcb8-495c-a57d-eb9b81ea0cb5", "indicator--f0008fe0-e729-4726-9754-d51bde217619", "indicator--4f84d9aa-70ba-4f5c-96f3-22791c97bf9f", "indicator--866e6edc-ddc6-46fd-af84-9630e7a7e684", "indicator--4ff313e1-833c-48e2-86f4-67cfa80020bd", "indicator--7f9e9b8a-eb27-4a82-8a26-20ecf1229eb0", "indicator--945436f9-e0a1-4830-87f6-6f6c58a09004", "indicator--8806c2f7-870c-42ac-9d00-5adcd16bb886", "indicator--46ee079a-2d3d-4412-9e03-26cb49eae66e", "indicator--c1e13f6c-4732-4383-a85f-1a8071d87675", "indicator--f080c8c8-490f-4cd5-87b5-2eae5c8bfa66", "indicator--8e288218-620d-457b-936c-fa920cf67b27", "indicator--c1084615-81b5-4c3e-b49e-1b898c9e6ed5", "indicator--7f9c78b3-0d23-4cc5-a37e-7e3778accdf3", "indicator--b044e21a-2f5c-4eaf-8167-63a47043c468", "indicator--52b4215f-55aa-4bf2-bd49-0dfe9d4652e3", "indicator--d8f70f93-d952-445a-af14-1611d922c4d0", "indicator--dbbd9ac6-df7b-4478-b9f4-7379ea418181", "indicator--6389fd73-622a-4073-84b5-9f751d58523e", "indicator--11f59864-674a-4966-93ae-c53b2e9140bc", "indicator--2aa5af8d-da8b-44e8-9838-c4dd1f0af355", "indicator--b6077465-bf76-4bf8-8644-82fa3c8a8fdc", "indicator--7518433c-4be9-4b23-91ca-9b5605f233bc", "indicator--bd642066-8bdd-49a2-9181-efca2353fe67", "indicator--77f6fe97-f641-4513-b7b5-92467e680542", "indicator--aa220625-1cd4-4096-9c37-27a72eca459b", "indicator--63d788e7-e7e8-46d7-81ab-1f12739d2a7a", "indicator--76eb80d4-6bc2-4ee8-a239-65e8d067feed", "indicator--50ee99de-1824-40f1-a1b3-b407f802cdc8", "indicator--7151d07b-0a4f-4d0e-8ecc-b84b528e0715", "indicator--a492bccc-1da1-4bda-8f6b-3273a2367625", "indicator--fd05069d-855a-4b3f-89f0-c30791b32be4", "indicator--02092657-2627-45bb-afed-01497ce6208e", "indicator--ad0858dd-c849-4b2a-a79c-53c8404074b6", "indicator--8d0299ff-ad64-44cb-9302-a8f6031fb652", "indicator--e13e7e25-99d8-4f9d-9dd2-214409cc64c6", "indicator--a08ecf1d-6a92-426b-9502-a7333f0e6c2a", "indicator--57d5d1bb-bb38-4550-9ace-bb159af80a71", "indicator--5082333b-5ee2-45f7-8022-d796d133c7f5", "indicator--503cda4f-b4e7-4755-bcff-da39ceba90d0", "indicator--ae835225-7383-42fe-8f89-cab8783eb738", "indicator--99db0c04-4f55-453c-b4de-d752c5cec1d6", "indicator--c3ed66cb-1f66-4da1-a644-1c0d5832ea62", "indicator--f9215fda-5ae4-4545-bee9-70c0f0e67232", "indicator--92b70ad6-7ed3-4525-888b-798c6298ebdd", "indicator--1c38a25d-4cc5-4db9-90b6-1856e348803c", "indicator--9e3ffd74-efc4-444a-99d4-465f1e84202b", "indicator--94e638d7-415f-4454-9f55-bbfdc922ea29", "indicator--f8e31492-5e3f-44be-9645-48755c06d831", "relationship--7b1aa9fe-ac70-4d2a-a3d9-af6f35996d48", "relationship--5e371fb9-597d-4a47-8527-01af5f787f6a", "relationship--006b903d-8aec-42fa-91f2-eb2a8239be84", "relationship--7df10cbe-15f1-414e-a7d1-29ed153257e2", "indicator--e4462baf-6e3c-46ac-bbd6-5eb9197b7167", "indicator--830710ba-167b-480a-b7b3-f073490eda17", "indicator--89b96dea-9d82-408f-886c-a01b7995010e", "indicator--eb033612-7e20-47d3-8377-4b66ebc44b65", "indicator--f181d465-ea12-46df-8f92-76b9168ad9b9", "indicator--149756d1-6a66-417c-bfa4-c434fa5a0bc8", "indicator--4a0088c8-4945-47e0-b28f-eb14d3f065b2", "indicator--b73afb53-73f9-4bb3-9343-03672b8d5718", "indicator--054a4096-a15f-4a7b-8e97-9526a3a9d22b", "indicator--541a3016-e445-4046-8cf1-a9a5db49fd59", "indicator--566c6245-4256-47d7-aacb-11b58eda5b10", "indicator--d7bdcb9a-4830-4626-8864-f679a04f4393", "indicator--1fd32b89-50e9-4b73-b86d-619725e9b97d", "indicator--c4b674f2-18b6-465e-b511-8102f05a577d", "indicator--9db70e13-8535-4696-94ea-a10d332e4ae8", "indicator--a2027c26-2849-4538-b380-501109e236cb", "indicator--1136ab93-8abc-4e5e-88c0-23cfec1e0a50", "indicator--105a1528-6ad4-4685-bc94-e142bf7a7b1f", "indicator--7d0959eb-fb52-4bf2-a3bf-f61ed86e535f", "indicator--fb515663-6447-42e1-b345-c737daffe178", "indicator--f9448b32-4079-4e80-a48d-ee4c14995e3d", "indicator--5475a06c-0cf9-436a-af81-0ea7bf6acac4", "indicator--32a00c5b-6ead-4b40-955a-dc8d9c4ef6db", "indicator--250a4fbb-cbae-47e8-ac3e-b527b737fa05", "indicator--f508ba95-5e81-4f9c-9354-bf50f68f1d5a", "indicator--e52092e1-4bc7-4bdd-978a-03081cdd777f", "indicator--ca3e0253-882c-426b-81ac-87b7659a2174", "indicator--141c85d6-6314-478e-991a-51284f61e207", "indicator--9dd9c23e-96d0-4487-a99d-6e75da8d2e6d", "indicator--dd45877c-d3d9-4d13-bbce-db0132f05c3e", "indicator--e5d4354a-7f4f-4472-bb5b-d1794fc1cada", "indicator--a0b411d4-eaa2-4fb7-ab88-d4925a3c1c80", "indicator--b1b7c6ca-ba48-4b0f-b60a-796afeeeb460", "indicator--391b48b0-4667-498a-923f-de04835a656f", "indicator--1c3a2f1c-e85a-4649-9c70-af93f6464739", "indicator--e9f9a454-3596-4b0c-aaa9-468cd91bc056", "indicator--35180f55-905f-403e-93b8-0f8b21fe4e96", "indicator--1a7fb018-c140-4eb4-b190-c7f5ae1b83bc", "indicator--d72287aa-9dde-4465-9bd2-f40d16774194", "indicator--6935ee54-f030-4dfe-96c1-4a81d88874db", "indicator--58cb1183-85c4-4464-93ea-ee59f26c7c53", "indicator--13a0e442-e337-4312-8506-3f23bdb76cfb", "indicator--a6f8d4e8-ce04-4448-bd8c-ee5f0667299b", "indicator--e9509306-abcd-4719-b33f-3795b1de006a", "indicator--107650fc-b81b-4413-9cfb-3f622521c3f8", "indicator--8344c885-dba5-4b33-8668-493b986a00d1", "indicator--5fd50a3d-45d0-4b34-b0ff-9dd2080fb97f", "indicator--08be91e4-cd76-439f-8c61-098104b4dd7a", "indicator--0801fff5-6b74-4022-9c4e-fdeec00086d0", "indicator--8731ae65-5c26-4704-a965-73c49ffe26bf", "indicator--e6fa47ce-72dc-480e-8440-d6e4995a39c9", "indicator--33efab7f-03f9-4944-9611-b978d9125fb4", "indicator--61cef3b7-3344-4e44-a002-46182eed0467", "indicator--7fe3d479-bb0d-4cc6-a995-62e20adac30c", "indicator--79303527-87be-49ae-988d-b4df9d176055", "indicator--f75c1e99-6269-4963-b2c3-b735f5500109", "indicator--1e53b280-b4b6-4cd6-8dc4-06a5f83742ae", "indicator--31aa528f-0896-42f8-9cba-85e687453e2c", "indicator--6f599d54-b078-448e-bd83-968acd8f0825", "indicator--cfc8a06f-d451-46ca-aab4-804846ff25be", "indicator--4dfe733e-6c81-49cc-8e39-bf759e8a9a4e", "indicator--f4ee3e94-81d9-4f76-aa79-7713231aaad0", "indicator--d7f3f5e3-33b0-4d10-9a29-4887c2605313", "indicator--07f42269-1d19-4625-b002-37f3fefc9730", "indicator--6d44b472-5dff-4edf-91cd-6cac8c33b75a", "indicator--9146cfe4-dec1-48fa-b28c-afdc7ee94c32", "indicator--8c8f7a0a-7363-4474-8bcc-77773be89c8e", "indicator--d63cd466-7e82-4002-82fd-1b7150adb270", "indicator--6553ca75-3925-4275-9ece-11f3a8452d70", "indicator--d084e9cc-98e5-4594-80ec-eb51894a4efa", "indicator--0ba78612-58b8-47a6-bb86-dc957975d83c", "indicator--fb155af0-47e5-4f1e-8615-9395d2439fa2", "indicator--9461d3c9-6651-4531-b1e2-ab355db9a60d", "indicator--51e871a7-125f-43cc-992a-2212c216cec3", "indicator--f8721a3d-147a-4b07-aae5-a0c497eb6602", "indicator--b69dd198-de6f-4280-a755-4ef0df4c3e20", "indicator--b8c77328-251c-47c6-9758-ac469bbb5ff7", "indicator--11bca421-df99-4689-bbe0-75af509666eb", "indicator--706785fc-7124-425d-a3ba-4b168fd683f3", "indicator--d92118c3-225e-4bd7-b8cb-ca62db3f52b4", "indicator--48b58123-5642-4bc4-937a-33d695eaa336", "indicator--cfd9361e-00b7-48f8-9761-b832a6aba5af", "indicator--e3384756-7e8c-4a8a-96ff-6d448cc5d323", "indicator--b7fd370e-2138-498b-aacf-8b7f177a692b", "indicator--152225d2-a5c4-43ac-b40d-aec7758c6bbc", "indicator--4356c39c-0a4d-4351-9b83-57e1be650d32", "indicator--18763a33-c55e-4f43-9f5a-c30b30d2d260", "indicator--1335fadc-9c1c-4e11-9907-1b25b58b9886", "indicator--40f79bda-ccc1-470d-a66b-8154132e5c47", "indicator--a62ba161-9e28-49c6-bdf0-39fd4137e71e", "indicator--22b6556f-1b21-421f-9be8-dcccb8dca126", "indicator--bc63d9a2-da16-43d5-ae06-c6e9f50a0d39", "indicator--e8d764ee-18e0-4fb7-9189-b39f7576cdb0", "indicator--c4596a1f-d639-4b29-8650-34b6b5717319", "indicator--932bbffb-6a20-4498-afe5-f849c82d60e3", "indicator--7e11f502-9037-4dcc-a13a-798858cc119a", "indicator--fea85744-f514-4e64-a4ec-50d62c36acaf", "indicator--e00b9d90-19a3-4563-8fa7-dee580cc043b", "indicator--5f344702-3b5b-4fe2-bbab-94ae27e4a05a", "indicator--bc05b90d-f5af-4bb9-b87d-1a9ff44fa911", "indicator--1ff5a3ce-58ca-43a6-927c-b1dc1f84bbca", "indicator--0c75b8d1-250f-4f39-a336-8210a1541c27", "indicator--58cf1519-8191-4c5c-9fd8-c9c98f2bda5f", "indicator--fcf1a80e-5eab-44e4-a1ca-a4d6670844d0", "indicator--b61ed17c-fe57-4540-b304-5960f56bf6b6", "indicator--8fb3856c-99d2-4fee-8fed-62d30152d7d0", "indicator--e0a307a0-3947-4425-b913-42ad8ae12cd2", "indicator--784e8dfa-3302-4e4c-b950-5a2aa6f4913b", "indicator--3fe29ae1-9490-4c57-a55e-0ff858c6efb9", "indicator--0e64bed6-5e88-453b-9de1-34d4ff078815", "indicator--843a2919-8dd0-4146-a92d-c3b3283684dc", "indicator--cc9019ca-9979-4d3e-93cf-1b0b071a0a56", "indicator--43b94030-e725-417c-9c73-b6a009e16c3b", "indicator--94276aea-790f-4b9d-a407-918032272772", "indicator--20f6ae87-d2fc-43bc-b062-1f0bffda1ce4", "indicator--82fb52cf-4724-4822-a195-5bdb44a6526d", "indicator--448ddc1d-72e4-4971-a758-be00d13defa6", "indicator--5544294f-7885-408f-b180-0e3f60d7d7ee", "sighting--0075699e-10d0-45ac-b458-2f125c6fc4ef", "sighting--7645ca6a-321d-4709-be6e-4dba5531f10d", "sighting--b9393e78-d68a-4899-b01b-bc153ddeea90", "sighting--948573f0-1042-485f-a027-52b69f47ea7a", "sighting--8157f92f-8631-49d4-8eff-87a2a0499c01", "sighting--445b71ad-ae8f-4367-885c-343ce8b4a07b", "sighting--08054754-9a3d-4c8f-8f3f-32aaee869e19", "sighting--2e0780cc-59c1-44f1-9c84-76c9d4dfad27", "sighting--d49acec6-3073-4dd5-b2e9-fd8f975d7c18", "sighting--f7919ba2-c2ad-436a-8011-e338cf3aedf2", "sighting--6e31498f-5722-48b1-9be1-5f6a5eb65519", "sighting--aedcdcdc-3821-4195-b1ef-83ccbe8642d7", "sighting--44e5a425-3e21-48ff-9dc5-d3d5b0543360", "sighting--904f1966-0fe8-4f3e-807b-73589749b948", "sighting--9c6c6d16-7e9b-41e8-8e6a-4556cf05b922", "sighting--cbfdd9d0-eaec-482b-ad5d-309fd87af429", "sighting--281d1118-5a5a-44c7-b3b3-d9635f3803b1", "sighting--2e2aa0a8-b5d4-4dbc-8db8-1577f465813c", "sighting--c52353c1-1466-4f51-81b1-0a89f45b2567", "sighting--8f84cb67-7867-4e47-89b0-3f9c4b1eaa4e", "sighting--f7668d3c-26d9-4385-bc95-ce5ddf8ddd5b", "sighting--4f4a8f5e-6001-4498-a51a-c4502b38cb33", "sighting--d5e3313d-34eb-4834-a00c-f0e6e1b1b277", "sighting--665e2fcb-9c0c-4104-b459-8e2952e31bb8", "sighting--cad4402a-edfc-4014-a523-4122f8e84dae", "sighting--97275911-1bd5-4ef5-b267-cd1eae6c9eca", "sighting--a4dc951a-7c2d-4748-b55f-510a0809e614", "sighting--2debf4a0-981f-485f-a69d-1d021a6edff9", "sighting--f0ef7569-6197-4e81-b0a5-aa5148d903af", "sighting--1d4210ba-cdd1-48cd-87e0-41d267e135a0", "sighting--5c5c832d-7ed8-4146-8f15-e9249887f68d", "sighting--a32dd878-0b4e-4d24-a645-8b270e58fa4d", "sighting--5cdf21e6-0ce3-4e61-8feb-d2f7a5d9cc0f", "sighting--c884d540-e32c-44cb-b488-691e7ea99fea", "sighting--5b6d959f-eed4-44e1-8c83-1f5fc5f864e2", "sighting--3b61d7b1-abce-4c9e-83d6-6f71f6cba704", "sighting--4aadab07-d8e6-4d02-8422-3ff5d520c35c", "sighting--843f7798-6cb6-4428-9b36-39677683c548", "sighting--10b4f316-5ef8-4650-abd5-4171220a6ffe", "sighting--7ce87a28-454f-4e02-a548-2fbb82adcb6e", "sighting--b460f0f7-4d4a-4d5e-8790-1243b97f7d66", "sighting--a26e5d9c-5f26-479d-992d-a4777abbb951", "sighting--57d07b0a-a2ce-4981-a7d5-0872c5326f2a", "sighting--4f99c3c6-d517-4b6e-8909-7953dc7bf1b5", "sighting--aa370bf2-6a89-4847-9a40-2cbbb169067b", "sighting--4d5f32b4-b44e-4149-abe4-304505be499a", "sighting--7cb195a9-af75-4786-b390-6286eae12420", "sighting--1b262906-7ed9-4da5-b9f1-a3aac68b46e3", "sighting--47bacc3b-9680-4033-aee7-5f75f072fe2f", "sighting--6f18b048-3d43-475b-8a3f-94f2fd9293d8", "sighting--a6c3bfaa-a36c-4016-a1aa-9cefb4339f6f", "sighting--b908d948-85e4-4771-a886-adba8e1cd184", "sighting--87c9a9a4-6379-496e-83ed-d504fc8e5331", "sighting--f6768cff-bf06-412f-bf72-061d227cbb4b", "sighting--16307136-7aeb-4e64-8d48-97a8c2864823", "sighting--774b5c74-528d-4ee6-8a61-a9dfdf918973", "sighting--00e73c75-79f6-46dd-b542-b0d6d8ab0923", "sighting--ed73de40-e7c0-43ff-820d-6dc79b277031", "sighting--1683edab-41d8-4964-8a5d-a0acf283caa4", "sighting--58afe390-80bc-48e5-bcba-184141fe4b94", "sighting--2a38ec2b-0a93-43b9-b8e2-26d50febe41c", "sighting--fb13613f-a4db-4751-aeb2-42ce232d3d97", "sighting--759bf79b-4008-48d4-89f5-c0b3d66e60ff", "sighting--23a3620d-8120-433c-be57-92d819033abc", "sighting--c7d60a1b-9f0f-4dee-a5a3-3c5fc256d443", "sighting--e82aa730-650a-4c8b-bf83-5d88ee1902b5", "sighting--8ce16be1-d4e3-4dd7-a256-434e33b18f60", "sighting--092efc58-6e10-47c9-a098-0cebb3c96781", "sighting--af97337b-b096-4112-b9d2-11b8dc0c0cd0", "sighting--ec9dd71d-e38b-4160-84ce-05e0eddad0dc", "sighting--85b7a091-100e-4adf-8234-b6872ae90c4e", "sighting--2c714c25-7831-4305-ac2d-e4d3f3c20668", "sighting--54c5e133-3310-4a04-a01d-79d65754f6af", "sighting--7e6033c2-dcef-4f66-805e-4dc9cb983709", "sighting--33251647-be0a-4772-9480-429e99c25bb9", "sighting--afe2272f-a631-4889-a751-b3bcbf6414f2", "sighting--06dcd604-8b98-4408-a684-8f3705feab7b", "sighting--6f8b3cce-0fcf-4315-8091-1afd34c4a9cb", "sighting--b9a18cdc-05cc-4189-ad9c-ac56e75881c9", "sighting--fb0c0efe-33f5-4d2e-bfac-83f2cd82fb97", "sighting--eb71d400-30e6-4dab-abb9-03f9349899a5", "sighting--6fd7ec44-da35-46e7-aaf9-e27300b3b092", "sighting--21084a1e-3613-4c69-9844-62081daa1eaf", "sighting--95f03a1d-b074-4790-aac0-2c77e81fad1b", "sighting--0c6121ee-20c6-4266-82ea-734d7ac2272c", "sighting--336c9813-a873-4709-9c86-964c7d7e0260", "sighting--4824d475-6cb1-4a00-9ee4-d2ddcd0025fb", "sighting--da68764f-584c-4aae-9bc7-e36111d4fb0d", "sighting--aca208f7-134d-4088-b701-2fcc8198fc1b", "sighting--31f67740-d96f-476f-8def-a7a47c4e1e79", "sighting--020e64e0-bfaa-4c1e-a7da-9da98fd39a09", "sighting--4aeecece-80c7-4fa1-a58c-dbad61261aa3", "sighting--7a6f3763-2e89-42c8-a5f4-0ee62b4e84df", "sighting--9bc762b0-2c4b-4845-b7ff-509dbae2449a", "sighting--c04c5b09-aa48-4873-81c5-631a4c1f16d8", "sighting--10f3bb51-51b4-4cd1-a83a-73b4f675fe49", "sighting--9d1acb8b-5a1d-4a82-914c-dc306c778679", "sighting--d3cb66c6-7073-4e4c-a954-8072579484bb", "sighting--7d6271b9-808e-4f11-af14-62c011003bf8", "sighting--1cc1a437-b7d1-4699-89d2-7a6fa233a6fb", "sighting--cd7fe7f1-2512-4b9a-a32c-6ac3c77c47ad", "sighting--d5fc7ca7-9986-4849-8338-04566539a8a0", "sighting--033cd01b-9ef2-4688-a20a-97790151ca46", "sighting--60f8b761-22bc-4642-bbe1-c8be5a202d63", "sighting--40688004-8121-42fd-b47f-0112a976e334", "sighting--a3c52ce6-6b72-4e24-8f2c-7db2100e6879", "sighting--6841a086-21f5-47ea-babd-0bc7d8ea1e55", "sighting--d527e3bc-82ba-4f89-8949-1a3c341db887", "sighting--bc8ad694-de93-4b11-9f56-32ce9f077bd7", "sighting--8f529d73-49c4-4c92-9e0c-c23d1728a2ba", "sighting--3c90974b-ff0f-4212-804f-812c09a78056", "sighting--f3414605-c498-4418-9126-67edfa6890d9", "sighting--7c21ce1c-5365-4d6f-8ed4-0fbcdf74c3eb", "sighting--22bda3e2-6af7-495d-8b02-0a9b9cb1b1df", "sighting--f7516355-8591-4623-9e04-497395ac29a6", "sighting--4a82e8cd-428f-4e4a-bf1c-109cc5eac932", "sighting--e91b0605-bce1-4ea8-b419-5d7ac5d7ead1", "sighting--afb6bb6d-0748-45ef-bf5f-7e9e332865ed", "sighting--6c3606a2-1b65-45f2-849a-4653db960fc0", "sighting--b6c58674-359c-41ae-b1ef-4884c70ecae3", "sighting--8a65b2d7-03c2-48ed-90cc-8b41e50681f9", "sighting--285ad4d4-df17-49af-8647-31d6a0a2274a", "sighting--bc4a42f2-280e-44cc-8ed8-b1ced25e731e", "sighting--7eb51811-e8c9-4be6-a6b4-0f8fb177a1f8", "sighting--56cbb1aa-4f64-46df-b827-5cb9064b8a7b", "sighting--052d3484-bb66-4789-812d-55f2c745ac04", "sighting--52fa3d3f-3fbb-473d-8cd8-d3ee92c070e8", "sighting--c8c1863d-ea6e-4fe4-a154-9a02d3af5110", "sighting--bbb31c31-665c-4bce-8082-3f9fd8020822", "sighting--f39e9aa1-efa1-4bb9-8d35-fd7b90ebd2f5", "sighting--416ae2ce-a66e-41ff-83b5-d4937ac19830", "sighting--230b4888-1e3c-4527-ad38-356c04c45b07", "sighting--b684514e-abd1-422e-85e8-5e99f8d4bb1c", "sighting--6b417192-c3bf-462a-8f8e-b56defb4a477", "sighting--0f518766-4a0e-44ae-956f-a11b1235e383", "sighting--ac5b78ac-5a4e-47f4-b68f-3c65ec4810a7", "sighting--5ed7b0bd-9a82-45be-accd-8f1403c8eb99", "sighting--38a737d3-a284-4728-b029-48c79d412909", "sighting--62f27b83-f69d-4086-95e7-c650d02bc719", "sighting--ba7c5bf2-bb75-4870-88e7-c154a7ca10c5", "sighting--a041b384-09b5-4614-a39f-ce71670979ae", "sighting--b2a197e6-5cdf-4d78-b63e-c73b3a27cce1", "sighting--73dff712-8d9d-49a1-af9d-7c4a559c8614", "sighting--79c37359-41bf-4d1f-85e0-83b4a5151918", "sighting--c451275b-bbff-4dcd-86fa-9e048dce075a", "sighting--a9e1b594-6326-4370-9868-c94ed00f7c98", "sighting--8ab2200b-2d6a-4a4a-934d-3137377b2ac8", "sighting--31b9a506-8acb-42be-bc15-957d64c695d1", "sighting--8956e700-e2be-46e6-8c19-9b3762a0e0f8", "sighting--7c8b739d-e8b4-4bf5-bf9e-01b43782e4dc", "sighting--c442fda4-0c40-48ae-84ae-4d7a8aaf0c01", "sighting--153d6366-4147-4d99-8de3-3b2a503fe39a", "sighting--302c76df-d655-443a-87b9-1111c836bbdf", "sighting--008e8fb3-b44b-4197-91c4-a0f36673fd29", "sighting--045d8789-a189-42b6-a08d-dff9a14c623c", "sighting--05d0f0c5-6c9a-4962-9d20-a48a214b1829", "sighting--64379ab6-6926-4789-ba0e-b079e7e11ee6", "sighting--69c3f4b5-66fa-43b2-b332-1eb8570f3b49", "sighting--5efa653e-e241-4c26-a472-beb9dabe8fe8", "sighting--3c0a4e03-4726-4d2d-b4f4-2cbbafd34d3c", "sighting--5f279fd8-d3bd-41f9-90d9-88c63ebaa143", "sighting--a6b177fa-bc1a-4a3b-b073-0a15a7b81208", "sighting--8e8d86b3-b5e0-49ec-b84a-9d1494356b42", "sighting--895c74d6-3353-43ec-813f-8f617a5a2680", "sighting--48c274b8-0020-4873-a9f7-6c14afe2cdda", "sighting--8815b062-e321-4f91-9866-065e764b05b2", "sighting--8ff1a0a2-7ceb-437b-a0bf-15128469703f", "sighting--6dbb227f-1fc7-4cd1-b339-666dd57acdf3", "sighting--2e6dbc10-81bc-4794-9a4f-af38447f0187", "sighting--72f63632-8008-4779-a22a-f32fd26658f7", "sighting--ffced2e0-1dff-48c9-8532-dd3e7ac10a42", "sighting--b5800e3f-ca0b-4f79-ac5f-9a650b3c0228", "sighting--a78f26f3-7803-4d7b-8a00-cca6c1aea1e7", "sighting--a6164872-f64b-4de3-8312-b0d10d9fc4e8", "sighting--3a6c4229-f812-43a0-826d-66453684b30a", "sighting--2e367ef1-a199-44c0-a103-f30407fd71e1", "sighting--cf885390-7d10-4c0b-947f-95cad8a1534d", "sighting--76a3d8d8-eeb7-4204-9e67-145f538b6063", "sighting--84288afd-3abc-492b-a6e5-bcf7ffb87c1c", "sighting--45e6692a-f952-4559-850f-3b9b248acd50", "sighting--9b575fa3-2300-4303-94b7-dd12cd6068ad", "sighting--011eb644-fecd-45c3-a4ff-b5b74afccfc2", "sighting--e20bdf29-74be-4f8e-bd45-c347a168f1bf", "sighting--a679a9c3-8666-4d74-87ad-856b06177ee1", "sighting--a069258d-7f72-44f6-8377-0ea079c86c2e", "sighting--ff4b5e10-342b-46e5-8cc3-1c9a44054885", "sighting--e22b3d99-f690-4328-bbef-e6c0aed2a1bf", "sighting--cd0e9316-87f4-40f9-a121-b224fe640f7f", "sighting--5b008802-c94d-4c97-b891-858888362370", "sighting--b04dc5f3-0707-4a91-8b18-bf487baa3139", "sighting--af5d89d2-13cd-490c-8ca7-db261dc38af6", "sighting--4ddf7fe7-b896-417c-9b10-35960d1c2083", "sighting--aeb628cf-90e1-4145-8010-7c5c88a7a981", "sighting--850ae316-3af9-40a9-b48d-b88938e83a84", "sighting--77c6a3da-7e42-4b94-8359-a6c4e28668d0", "sighting--39856438-50c5-4589-9fdf-54d16fac15a4", "sighting--41b767d9-f8c7-4c9b-b596-5482ae0b06c1", "sighting--74d9bd9d-c04b-49a4-a432-e05e86d090d3", "sighting--3bf2e1dc-55e5-4d31-8eec-61b2836ddd9e", "sighting--4d6c0160-b496-4893-aa7b-74acccc3ce22", "sighting--b98a797f-0f97-4490-8ee8-4bc8cbe559ee", "sighting--033f7622-7155-43fd-b8ec-fedb5e63686e", "sighting--670fafea-dcff-47ca-b6a8-2347f2b0b66b", "sighting--538ad14c-f863-4130-8f4c-3aa2361e1ac4", "sighting--82110c76-29cd-4719-91e2-15fea10e9e5d", "sighting--bdd6b370-fbbb-450b-8e06-11a61159c0ab", "sighting--35d1f934-7f79-4930-824a-7e728cd8d596", "sighting--89b69313-0667-45bc-95bd-e1914fd38379", "sighting--b631935f-5686-45d0-a774-513f0e625050", "sighting--de642ecc-dba8-4b98-aaa5-1d1293c8a796", "sighting--e36c1a52-35c4-4cff-8116-b4f278ebfd3f", "sighting--4e236381-d8a6-40dc-9311-3b38f14fa3b7", "sighting--a381690f-b589-4fb7-9148-ebb80d50019a", "sighting--00febfd1-d47c-494b-961d-4d07f22b9412", "sighting--05b231fc-99be-42a5-b112-24a3da7e6fdb", "sighting--5968bd87-5e0a-4342-a19a-c2f797358c82", "sighting--4d04d0a1-1d49-4516-8784-d77db0662359", "sighting--a74bc083-ddb2-4c70-b51d-eabdce5fbc57", "sighting--34009b7b-2ea8-47dc-8344-a7c4bd4abb9f", "sighting--d8dafacc-a2f2-4a22-ba64-f1535330ae70", "sighting--d2ecf207-8088-4984-99d8-9690d4fd5e26", "sighting--75f0e81a-0ca0-4c59-a8f0-f77a6ba34e76", "sighting--3e806d34-96cd-4fa5-9b3d-405ac8c02403", "sighting--17c68ea8-f081-4dcb-84db-fd5d13a72979", "sighting--d22c4ae1-5c26-4694-95a9-24e13d6ba54e", "sighting--deaf7f49-fa73-4feb-ba7d-a86763dec9fc", "sighting--320664f8-7117-4be6-aa16-9916474b01bc", "sighting--a9c4492b-0f34-4424-a078-abff0513b943", "sighting--4e3648de-d581-4194-9d05-52ad4b0ff9e5", "sighting--d9ed716a-731a-4b58-ac42-4741770050ca", "sighting--67460a17-e62d-4bb0-97f4-15f7d4224778", "sighting--2ed914b8-f252-4ce3-bc83-38a984d669e7", "sighting--4860a90e-5dfc-401e-821f-6ad6f3739952", "sighting--407ca673-0a60-44e7-a08d-9ee2f648c6c9", "sighting--4bd8bd41-35bf-4b26-b936-8ebc59cf8426", "sighting--5957fb8c-f39e-48f3-84d1-dcfa4584017c", "sighting--d394c927-6c1e-4cbd-ad0b-05d470cb7710", "sighting--a24728cb-fdbb-4533-ab05-218884e9ed8e", "sighting--95126b4c-445b-4b2b-9950-47e3107c96d0", "sighting--9d7d7aee-4a6a-4087-8f7a-6fe6233a0840", "sighting--6f448000-3f18-4abf-8a9e-f143c265b1e1", "sighting--a7ba444b-29d9-4491-bb7c-ffc3a41904de", "sighting--55598508-0a9f-46ec-a54f-244d6ea9b548", "sighting--c24d8b3f-267c-458a-8ce9-dc6dcda10905", "sighting--3aa8c082-f89b-483d-82e8-03fe09d8d774", "sighting--47244e4d-dd8e-45f3-9010-d1cf2a94834f", "sighting--02b31469-45f7-4de1-ba40-77b16a3d4964", "sighting--c8ad1401-d88b-46d9-84d5-23f3947ff78a", "sighting--583d65cb-55a8-43ab-90c1-4cc596f4abe7", "sighting--bb87a7c0-ff57-4786-9fd6-dc1fd1548d8e", "sighting--690d5e37-83d6-484d-99a9-ee7beee074e1", "sighting--b3af380e-e4be-4c67-a277-54e24d2947ad", "sighting--5dfa7b82-6f9e-42cc-8dfb-1b7f7c6b1527", "sighting--774d32c3-30b2-4e52-a9ed-e11bfc40e3e7", "sighting--a1e03e9a-be0b-4e19-be52-9912f1d0be33", "sighting--b3b3222c-6817-4b5e-89f6-4c86b289ac03", "sighting--a99ec26d-7ffd-4681-b71f-b2deccb6c493", "sighting--454a9f0b-ec5b-44f0-9506-6f27dba489bc", "sighting--a24d2986-5ccd-4906-b658-27c14745f5b7", "sighting--c20963a0-0cfa-4593-8c1f-f7d4aa9133a3", "sighting--73254e09-d7e5-4444-9c06-73e713e59a37", "sighting--2b6b92f6-e143-4704-ad02-56c5a6b4c8de", "sighting--0b264d35-3d5d-4ae3-8b23-8494e1ab2c59", "sighting--4c62da1b-f339-4fce-8b28-d52a65df8bf3", "sighting--135624bc-608f-463e-b80e-fa97178f6a2c", "sighting--a7c15ba8-e96e-4c6f-8725-c700e62ad212", "sighting--68ff7330-ff84-4fd6-8976-f06dc568db41", "sighting--a8befca1-9874-4897-b562-5bdce3f92515", "sighting--aac3e7bf-b5b1-4597-b864-6055d249e911", "sighting--1d305533-7286-4df5-be93-32f229cb2ed4", "sighting--c7451103-e3e0-40d4-8681-67ae0d6bc539", "sighting--3abca72c-c673-433a-beb0-936b79be178d", "sighting--dffa204d-4a33-44b3-819a-a9bb63cbd965", "sighting--8216421e-c675-4785-9d79-5424b7abe25f", "sighting--a43e4574-daea-401b-a85d-84e602a683c5", "sighting--726f4573-209e-4a9b-a2de-b27c750e65ca", "sighting--3052d513-bfc0-4d89-a897-2a86fe885cf9", "sighting--a8dc0ead-254d-4822-8c64-f4e240fc7d0a", "sighting--68b1eca8-31ae-463e-b410-333b6a6cdec3", "sighting--c7da1b43-c579-4c9b-bd75-d33c422a8339", "sighting--87eb53c2-d0ae-4473-9eff-a280c72bf1b7", "sighting--cf44cf25-adc1-4295-9845-4d4f41e58bc1", "sighting--684e2c05-bf61-47bd-aaeb-f91127c379fa", "sighting--302aeb86-4739-4abe-b9fb-2775a67e16c1", "sighting--5f32d1b9-870d-4468-ad68-905405e009b4", "sighting--7e3c0b07-cb22-4147-83c2-a1e8000a39b5", "sighting--0993b7cd-44db-499d-a9bf-f51de423698b", "sighting--c18dfa40-4260-4c13-a655-6baf82fa3354", "sighting--046464e0-c00e-4dc5-82b2-89cd393a9a08", "sighting--65b6b035-fd52-4212-98cc-332a025cb89d", "sighting--f1c64730-8820-4041-98a8-3bdd274bccaa", "sighting--1cdfb6cc-5f4f-4283-a13a-feb0fbe1eb21", "sighting--fb8faa12-8820-4d74-be89-27edb7f44d9f", "sighting--49e9997c-693c-4875-a266-aa799b6e3c90", "sighting--aea7bbbb-b2fb-4511-abda-5fd200cd721f", "sighting--67f155f5-d14d-48e7-80fe-81ef5b8bb645", "sighting--5087d85d-e152-485f-b7be-903957127463", "sighting--06db10d5-fb13-4136-b312-e222971d6ea0", "sighting--27f4158c-29f5-4898-9310-152b7a920aed", "sighting--ea5fca32-054f-456a-9f10-5a365f624d80", "sighting--bb301fc4-f238-499c-99a4-b064a7b9c2ea", "sighting--48c13d8a-5b57-4abd-a2b4-bd50cb0f7498", "sighting--23810fc4-57a0-4cdd-acd1-a397696e08fa", "sighting--c27513b3-7df8-4d3e-b06c-b0443d3ae5af", "sighting--b1294024-a9ae-4073-b683-40d2f1a456c0", "sighting--c171f967-f8d0-4d59-bccc-476c4242d4c7", "sighting--2c8662dc-9beb-4516-91f8-d3721c16dddd", "sighting--1bd4ba09-a095-42ad-9902-bb121b0eef99", "sighting--e8474ac0-8925-4edc-acfe-60c5ed7dc45f", "sighting--10fbeea6-9c28-429c-96d4-860fa8a4bfc3", "sighting--e4006f01-dbce-4e61-a5d2-401c50fabce5", "sighting--8de9bbf3-0179-4767-892d-2b0b28a897e3", "sighting--0c460477-2c50-4b38-9d1b-b5cac423bf4d", "sighting--284d50b3-8964-4658-8277-ffd068aac3c7", "sighting--832598b6-e814-48ef-91d0-cefb75fcef92", "sighting--1f7aa112-7aea-4149-ac88-83e73b6ebf1b", "sighting--9a8e673c-4fad-4409-a6df-047b908ebce7", "sighting--0ec0c2ef-f50f-475d-a9d3-daf6b3ff0f72", "sighting--fbb29c4f-d167-453a-91aa-c1224037af55", "sighting--311b581f-6a4d-4e31-8301-ddf8f3ce3586", "sighting--fe9280fe-148b-493a-bf97-c9bf01b3b453", "sighting--6feea686-7e52-4ef0-a201-9b0f4d9fa04f", "sighting--f94a1944-275f-4f0c-ae3e-ab170580c15d", "sighting--ad8a0afb-c714-4d37-9375-e8067208b98c", "sighting--e7f37054-c984-4443-92c2-95c9058708b0", "sighting--8f0304f4-7ad8-4763-bfcf-24081b480e1b", "sighting--38de40b6-1032-4271-ad72-4eed51f2b715", "sighting--9a9c3b9b-95af-45d5-b7ab-6160b8bbe22a", "sighting--2bcf0055-8af6-43ec-a01f-7d03cd896d5f", "sighting--4cbf3a4b-c610-4f49-8bcb-2eab0782fe2c", "sighting--a9ff03ed-3d07-44eb-9008-109d98ee257b", "sighting--c2fc581a-2b4e-43da-9533-27358e55c53e", "sighting--688e1911-e960-43ee-9409-159dce0bedf0", "sighting--4821ff9c-bcd2-43b9-838c-d371cf5ba292", "sighting--bdd6da71-99bb-480b-9156-f025ad332b8b", "sighting--507ae8c8-a1a7-41e6-ab68-0c985a773471", "sighting--bfe35e3c-8dde-4181-a46c-0b1848db5b40", "sighting--3f7f8693-a761-4fb0-b889-5f29b49179b8", "sighting--ead4c2b3-daf7-49b1-ae69-0e9396110243", "sighting--5c2f6dd1-e9cc-4cab-82b6-89993ce76a7b", "sighting--e2db79a1-b31a-43ad-8a74-08aa6ccda577", "sighting--49795375-56e0-4b0d-b5a4-8d880a7b15b2", "sighting--07fd48c6-19c7-4dd2-9a04-ac36291f33ee", "sighting--750b3cc2-2a9b-4c02-8ed4-a0033716c40c", "sighting--1a1bbaed-5e76-4af1-b4f9-d3c3eeae6254", "sighting--ef8c4fc9-9208-4fc7-ab67-3d7125df4836", "sighting--80517591-7398-431e-a637-edb54c0c0f76", "sighting--c8b563e5-ff09-4dbb-be4c-31b5e6c52ac5", "sighting--5f75f1ba-7082-491d-9133-82cb7dc6c115", "sighting--e2dd03f8-a12e-4dc4-95c2-80fa0e02320b", "sighting--7f765758-a2fb-44d1-bddc-48f83e673c02", "sighting--c724ac8a-6be5-4511-a6a9-9714f404b570", "sighting--2a0f66fb-02fe-47a5-922d-384fb4b7175c", "sighting--2fb85751-16d6-405d-9b5f-924e6c83777c", "sighting--d07d0d44-4402-4935-bb10-ea1a120c14e3", "sighting--603cc5c3-95ed-44db-a7f7-0e9e4c1788b3", "sighting--00be63b8-db4f-4883-ad82-9c3e0eea7a9e", "sighting--3bbaf38d-c1c9-400a-88c5-dc89da3ff553", "sighting--9f538bef-0364-4536-8981-c9f9070313e2", "sighting--ffcd9862-4ff3-4964-9d1a-2747b6f254d1", "sighting--31429c08-9998-4aea-bdf4-f6419e8b759f", "sighting--3a0da491-d90c-41bf-8850-798c0644cb76", "sighting--3e1fe065-1780-4e29-b9d6-c360b6352a7d", "sighting--e2e1bfc8-6510-4b12-896c-2ad353bd3e9c", "sighting--05a985b7-ee57-47d9-9e78-fd2e54b13bee", "sighting--428c900c-3e59-4d80-ab6d-6f620d9a7dd3", "sighting--60d49cb8-37e8-4778-88bc-4991625b0426", "sighting--b749a902-ee37-4bb2-8b50-5742082b852f", "sighting--e5b13ac4-48fd-43ae-ace6-e82cf8c2c738", "sighting--853750d9-1688-45fd-a4f4-d4483b62832c", "sighting--3d34e3a1-0a68-462a-aa8c-0ee1b8e6d00e", "sighting--c0c8a086-6428-45e9-8e05-ed4271e015bc", "sighting--0aa0babd-1f80-4a33-bbb6-eb8060509c5c", "sighting--6f22c1d3-e3f7-4be7-b04a-e4bf42fc53e7", "sighting--c0a3fcdb-2407-4969-90ae-6de8f3ddba33", "sighting--583f8556-fe4b-422b-83e0-0c46072f0b9f", "sighting--a174e513-45ff-43ba-9882-dd8110fb8390", "sighting--cd3eb113-c56d-4f81-8e83-aacd394502a0", "sighting--8263a7db-532f-4b85-be45-dc5938707848", "sighting--01e9ee46-4827-4e2a-bfb8-9975063f6366", "sighting--0cfa53ed-f493-49a6-b34f-d68c062ebdd1", "sighting--ce9232e5-3f32-413a-8091-6060736ed59e", "sighting--295add9e-80e9-47ff-b1a4-45222f92f9ec", "sighting--c21e8961-5a63-4794-85c8-7a492ae9fbf6", "sighting--ebfe01f9-bc52-4a2a-8664-fb035235260e", "sighting--541cd1c0-3374-4df3-8289-d602b68c29b7", "sighting--fead1ec2-e400-42da-80c2-daa8cb5cff0d", "sighting--635ef694-7e91-4b94-a527-cbf3ff024299", "sighting--6b71b0e1-dd70-4e6e-b608-aa7777de618c", "sighting--93c4609f-e4e3-4ced-8ea7-25f55f275faf", "sighting--0d22f558-219c-4fe3-97d1-9bcbf5b7794f", "sighting--bbad6d1d-fe8d-4be9-b954-b4188891f64b", "sighting--b109bf66-8913-40b4-b3bd-834fd6da3d5b", "sighting--e3d67186-561b-4a2e-beed-4f7551aad6c9", "sighting--1fc76cc5-347d-4516-8f6e-4a96a3331a51", "sighting--6943ec2a-49ba-4fe5-85df-29e113644d7c", "sighting--6fe75c2a-141b-4e2f-883c-f06118d34806", "sighting--bc2f338a-1837-405d-b851-c6a711b41939", "sighting--1fe3fdb4-6625-40b5-adf6-d0b71e0df8d0", "sighting--c955be1e-07b6-43d9-8625-59a17619efd8", "sighting--01fd7842-c89c-4441-9ce5-d114ae1a69cc", "sighting--8b71d1b7-0514-44e6-bc78-dd46a006e1e9", "sighting--a9d37c69-3ff4-4f00-bef4-6df5a555e8cb", "sighting--4737e2d9-be72-48d5-8a8e-5a50999d6331", "sighting--0dc0a244-c2b3-4463-851e-89f8256eb035", "sighting--9f8b7ffb-81d2-4333-9c31-2d705bc8e6e5", "sighting--529519b1-5679-4578-a038-0dca740aaa8f", "sighting--4581869d-f6bd-4845-a6c6-49988e1c16c0", "sighting--aeb924d2-df95-411f-9554-7844e301dd2a", "sighting--53913195-359b-4da0-89cd-adf2505f4e29", "sighting--26ded8a0-33a7-457e-a2ad-7aff0480dbca", "sighting--b125c4bb-aedd-4d4b-9ab3-71c5ed8350e0", "sighting--6a94eac9-c9fb-4740-95e6-fae2437197a4", "sighting--bd2d1afe-b38a-44c5-a872-c763f9748cb1", "sighting--b43d1185-c271-498d-9740-3dd40ee14335", "sighting--59011843-a514-4c96-a1e1-3bdb473095f4", "sighting--d5f5fbe4-889c-455e-aa64-dd88dff231f7", "sighting--893f7417-fee2-4b57-9e11-17de757d3c20", "sighting--a803c180-6975-4758-818f-ff4d999a2424", "sighting--26747666-9b52-4dd4-bc16-e374bf2f77e1", "sighting--aa29189f-5043-49c2-b7d5-a41ef18470ee", "sighting--db5a5d17-cfc9-4234-920c-ad874d3a766a", "sighting--b6a4a3e0-4209-425e-9d01-b6bbf94d4cf2", "sighting--3b5a2259-23b8-4d7e-b84a-a676e4efa49f", "sighting--38d131f4-1530-4f0b-9aee-504d472dbe1b", "sighting--d4ed2e8d-fd26-4763-a6d9-532d83a51243", "sighting--4abd97cf-ce80-4362-90c8-9c7d0ff7a889", "sighting--9adbaf20-947f-4903-9cfe-9bb7bdcda2ac", "sighting--3510806c-a73a-49a6-91a0-86ecbda77ff0", "sighting--63f4688b-6c68-41e9-aa50-3134237f11df", "sighting--398c962c-9b89-4798-af77-c21645647c2d", "sighting--220891f1-6875-4d7b-8010-b36f986d806b", "sighting--d4f495cd-6d9f-4c52-827d-73094a235ae9", "sighting--88ff2a12-c687-4e94-8048-af5a92f3eacf", "sighting--494c68a4-02ae-4bb4-950a-167ec408a52d", "sighting--cb9954ba-8d2a-4344-ac98-2bbaa6e7815b", "sighting--69217dbf-b7f4-4fd6-8ffe-4246742c6880", "sighting--ba4b589f-80ff-4fbd-af36-f4ded992c12a", "sighting--11f30f9e-e0d9-484a-99b2-15df82c07cf8", "sighting--4e4d114f-0204-4d39-837c-c1ce1685a00d", "sighting--06a93697-018f-45c9-ad1e-29db3b9a5165", "sighting--a93ec779-cbeb-4d17-a2cd-1a47d781bbe4", "sighting--2287a382-8ce2-4f7f-982c-e1eb1854fd48", "sighting--1979702a-2b79-4c43-a8a7-9351794f3a8b", "sighting--7d78cd4b-ae24-4b1e-9142-5f6905dfd3e0", "sighting--cb63f8ae-f50e-435a-aa7f-b56b5d70653e", "sighting--cdbfa9e0-a661-49c2-9631-fb4bfcac0182", "sighting--c05a6ab8-f667-4c6b-a756-1bad69a64fb2", "sighting--f4e18fc6-e27a-49f9-acd3-305b0daaba57", "sighting--f36b8217-a348-456a-8d3b-53d0b6dedd14", "sighting--8711e0aa-b059-4244-beac-b503bc5af9e1", "sighting--91dd01a9-68e4-4d79-b14c-98961559311b", "sighting--bc6effbf-72fa-417c-8852-022e04e5f28c", "sighting--5902b2f0-1754-4a80-a922-e3a8a667c2bd", "sighting--cf4c408b-442a-466d-bc08-7b8850516379", "sighting--72c0af61-05e1-42f3-abe9-bb27409292b1", "sighting--5763df9f-d72a-43f4-99d9-449fa5fd862e", "sighting--44674bde-83e7-4f17-b46c-facd5c0e3216", "sighting--804972cb-bc8c-4f6e-92bb-36f9c2fba361", "sighting--efa6faec-ba03-417a-9916-2ff865f84af9", "sighting--104f1afc-f9d7-4125-b521-6a92007eb0d0", "sighting--df083b18-f982-435d-97e6-ce40f729ebc4", "sighting--6de2f654-ae6a-4167-85c6-997438220bea", "sighting--48bca54a-ba49-4ff7-95aa-cf3afd4f4c5f", "sighting--bc7a9518-7a53-4455-b557-0495fd3945aa", "sighting--15f62b9d-1491-4542-9973-7062127d3b3f", "sighting--751d2ff1-d882-48a3-bc55-c17dfd566d5b", "sighting--798c25b5-7300-4742-8d43-a6b9317bedd9", "sighting--8699e1e4-2d55-4cdf-a09b-ffc84d285577", "sighting--b3c63788-294f-4c5a-9d2f-f4f73969d076", "sighting--fa996f38-9e1b-4006-8f45-9e7b02568e43", "sighting--135d49bc-f076-4c57-9614-4cb86b847881", "sighting--6af7c525-fe63-4348-8aa3-b2ae02efcee9", "sighting--e6aa6b8d-3f86-4d77-828d-8a863b5d502c", "sighting--9def5795-fd83-4152-b5f4-1224d4ffd5c7", "sighting--ced3e548-1669-4ce4-909e-b4ada73bd557", "sighting--8a71f753-fd05-4743-8ccb-24026e153028", "sighting--b5582e2a-ce73-4e3e-8dca-b8c87b9803de", "sighting--2146cb98-4ef6-471f-b83f-8a609a9899b5", "sighting--58a63f42-9ee6-4b1d-a54b-846e9cad7468", "sighting--211bdd81-fe1d-405f-ab05-4d756d7e93c7", "sighting--dc17a36e-fe77-49b5-962a-0a57271183f2", "sighting--35aff7a7-a62a-4e21-a511-8e0883d590c3", "sighting--0d4ef56b-6408-4bbb-80ea-2078f5cd90e4", "sighting--fd4ea3fd-9e9d-472e-a4a0-a5208822adf8", "sighting--3b6a1c98-17ac-4ade-a600-1d51a4be1428", "sighting--387a1384-ca9a-49f2-8bca-dd7bee9c3556", "sighting--80a04d45-4b0b-4b9b-83d8-bee97d404733", "sighting--877a591b-bc4e-49ed-8d34-f2ab092005c9", "sighting--a0518955-33fd-448b-a97e-a37490e206ed", "sighting--056a4d72-89be-4cf7-b246-94666a4c81d5", "sighting--d9cacf1a-efbe-40fc-b44e-9c0d604846d8", "sighting--471ebfbd-da25-44f9-8db0-fbf623901212", "sighting--4bf13998-2bb9-45d5-950e-7c12d92f38a9", "sighting--f4299b67-08db-4368-9858-3eeb324bdf66", "sighting--3fc72bfa-27f4-4dc8-a3b2-60d8bac3e586", "sighting--97ae87ae-d5be-41f0-9a56-113de7cb540f", "sighting--d4d04af2-5d1a-433b-8fc3-c88bca51c29d", "sighting--a6d245e8-4ca0-4f9e-9f55-a7bdd115786f", "sighting--cecb5ffd-0abc-4437-8845-7567305b8adb", "sighting--3318805b-0a5b-4e76-8e6a-1d53211f7cd3", "sighting--a4f148f3-3094-4e27-b571-6279def7476b", "sighting--8c8ae7f3-8419-4a79-adf7-16f4e6585a6d", "sighting--15e084d6-b065-40c4-a2a0-fa4d3dc88be0", "sighting--fafc6960-69f8-4a9d-a30a-db81f821d3e7", "sighting--e0b5cfe1-7455-4074-a0fb-ad2f5357a403", "sighting--669ffaad-ecd4-46bb-aff6-53c3cd2af369", "sighting--61add8b4-72c0-4030-9858-c9ec246d0451", "sighting--63bdb8dd-d9f2-4041-9974-618ad88d7c6f", "sighting--60105a65-f841-474c-a5a6-8b7e2f353deb", "sighting--9aa70908-4b76-4f5d-8122-7ce18aa8f1e9", "sighting--f72ab1ba-38e9-43b0-807a-dcd4764ab805", "sighting--e6f14618-5410-4221-a860-e297a0228248", "sighting--a59d9666-f785-49e4-9332-b863a973a4e7", "sighting--5f2aa0e9-803a-4d05-ad43-feb8f7f6e93f", "sighting--6a01d408-38c8-4149-a403-9423253ed6de", "sighting--ef56869e-06d6-4532-84a2-04273a5a2c90", "sighting--d17afb81-4a38-4aa9-8f58-577b40534c47", "sighting--14da7ebd-f061-4437-b128-827d492eb408", "sighting--026f1165-599d-4adc-879c-d4c4da5a1b53", "sighting--5f6349ae-34ad-4d85-9a57-1ddb00bb05b2", "sighting--2bd238f1-e4df-4bf4-b681-937fda9e0444", "sighting--44a767aa-cc3e-45a5-8025-7630aa0f7076", "sighting--a20cb628-ba3c-47ed-a97d-35268d87af1d", "sighting--a8b767e8-4626-432f-985f-60dac0fda9e2", "sighting--c8d3f39e-e71c-40f7-ace9-ed9e3ea7c758", "sighting--3e36b06f-ec9b-44aa-832a-4407f5ea396c", "sighting--ca9b8d6e-2947-4f9c-a357-94f219b77b32", "sighting--42a6a3dc-b84a-4297-8155-178fa7128f8d", "sighting--085de3d5-85a5-4750-83f7-8014463e5c9b", "sighting--0655606c-b401-4fa7-a8a5-1a20beb7d480", "sighting--36a4ded2-4cbd-4615-877f-29b3e9cabeab", "sighting--3d0a3141-74e2-453d-a1a7-4f3abb82691f", "sighting--160d77de-a8b1-4a2d-8c24-7104a321a64a", "sighting--353b3c18-f395-408b-b5db-6e84a9fac9e9", "sighting--9bf69fb3-bfc3-4ec6-acc2-2ab0fb85df05", "sighting--88d0914c-cf84-4a41-a640-e242f78016e5", "sighting--d2c22a61-ecd6-4cd1-b22d-f49a302f49bc", "sighting--dcb9bf0a-0e11-4673-89f7-7a18392b1636", "sighting--65df9b54-98c8-4820-96fd-05d3d402d2d2", "sighting--64f09112-0894-4f54-9f20-c75d06a581cf", "sighting--6e81515b-7fc6-44f2-8e66-40380cb4f609", "sighting--5a5983d2-b467-4ab8-8df1-645baf866691", "sighting--7bb5c47f-6898-4024-a23d-6cffe5fa2d42", "sighting--9735cef4-d079-4513-9ff9-9ed48876018e", "sighting--2a4c6af2-4b83-438b-90f8-8283d98b235c", "sighting--92e80640-ad16-4a6e-9a2e-dcabf122208c", "sighting--ddc5ff13-0483-4e52-b847-f396ae7c9eba", "sighting--d8fd1c91-04e1-4aed-bc0e-8aca8b0e98d6", "sighting--d54a2172-03c2-4304-8c2d-84eda75e2d3e", "sighting--f81a19b5-8304-4965-b798-ac8f2e9d6f83", "sighting--8bdce214-e4de-4f5f-9ef8-c08f2959497f", "sighting--eb745e1c-3503-431b-9482-491b7c414e72", "sighting--468f6e05-e45e-452d-ae8f-90b015e22b6a", "sighting--52d6a434-c243-4ab4-ab27-1b7dcfe27ca8", "sighting--1ab32ede-b746-4ff2-9bd6-b2205d8a015d", "sighting--40ecdfa6-bf08-4e41-96cb-23371b1bbc66", "sighting--695a9ef7-6450-496a-8c75-bc36c43de1d4", "sighting--38396349-ab09-4814-9541-5a00ec1ddd9e", "sighting--a11d0051-2ec6-415e-a5e9-f4425e66d531", "sighting--35f0686c-84fa-40c8-9657-339add51a70d", "sighting--6bc3cf21-e6e2-4d98-8421-e2a1fb34ac83", "sighting--c02aded9-4e10-4e75-a343-0fa457d60688", "sighting--7cdf834d-576d-45ea-ab46-18e2925d6070", "sighting--1233f151-98bd-4077-ab53-182783df0222", "sighting--857dff9c-dc43-4368-ba9f-7a2579f2e501", "sighting--60bb30da-048f-4101-be94-1cd3ea26a3d8", "sighting--d9ea9fd5-2e22-4834-9646-34ebe39e388e", "sighting--a0423fd9-26b6-4534-90ab-cd451158194d", "sighting--561448cf-a36c-4c5c-96a5-41031ffe6d20", "sighting--22745de5-f3a4-4269-99f3-06f34af148b3", "sighting--f6b6787f-53de-46ab-afc3-d35f03010c95", "sighting--f9ef6a67-e7c9-442c-9479-29f36eb43b14", "sighting--7984a525-ebed-4f5e-938d-be5ba93c01ce", "sighting--b7406670-f430-4d72-b5cf-ab2fabc4045b", "sighting--e3a6f6d7-110b-4dff-8b40-7c9e42dc6830", "sighting--90cd5902-981e-4142-8586-717ead5b7170", "sighting--ecbad441-e16a-4429-a62a-4d8342d7864f", "sighting--78bff936-564e-4408-81a9-a2f882bd34a6", "sighting--c713bf32-2983-47f6-85a1-f30c1e8bc5ed", "sighting--3d153ed4-f247-48d7-86a6-e6a11d2e83c3", "sighting--cfb27592-d51a-44b7-8887-3cd3546cda83", "sighting--931d863f-d37f-47bd-8473-24e197ff0c91", "sighting--42400e2f-f153-4bf2-bf18-1dc8c27c554b", "sighting--7b0bcf43-639f-4958-8031-271641fa6384", "sighting--d0fb93ff-8b76-4aa4-987f-a7bfcc366bba", "sighting--d81a9d28-7add-430e-aa9f-8e6dc873e268", "sighting--48547dd9-7d23-4d9e-9d16-065da559854a", "sighting--66895ea4-f9e8-4c17-ba79-804e8d8d6e13", "sighting--6e64b579-6879-4981-9ed6-a220eb0b8a85", "sighting--8b43dc49-38fb-48c4-82c1-fa27f265e6cf", "sighting--e71956c2-971c-4900-9069-ff0248e43438", "sighting--262abc07-e6b3-424c-a771-a056a932adeb", "sighting--f2565862-5034-45db-83b1-ddda029c72bc", "sighting--5f8a6db3-57f2-45cd-8df0-076a8051cb11", "sighting--4a769523-0c9b-4e97-9af8-2362c9f8f5d7", "sighting--9ac1ff2a-929e-481e-9bdc-0845b9a8eb01", "sighting--3dca6783-3f87-4487-88ac-994aedd79633", "sighting--3053bd5b-ff57-4d4d-9bf0-cdde2613ae2c", "sighting--f1d29033-b7d5-4166-be24-363cc129f5b2", "sighting--4c808611-fa09-43ff-b5ea-39a7552aab8b", "sighting--8943c8cf-c02b-4fef-a27a-b8f1b9ec2f10", "sighting--d9415a70-e81f-4811-8c02-57ac7cfa295e", "sighting--ed62af46-70ff-4c09-8566-b25177ade166", "sighting--4b6145f1-dcd7-45c8-833d-ff6d0de3d44f", "sighting--0f3b1df6-45f7-4147-80a2-e7dfa8df0ac1", "sighting--d3bec00a-1b90-408d-8a4f-784401fb9f9c", "sighting--221f807a-9964-4e64-a299-1bba56100aaa", "sighting--c7c7953e-b07a-494f-a776-2de41df47898", "sighting--75ab02b5-06e6-49b1-b637-e749b853b4c1", "sighting--a157f589-cd9c-4b1b-8cb8-a5acee6cb027", "sighting--044dd25b-fd1c-49b2-82d0-2fc76610ec17", "sighting--75352fb7-bcf0-4b0e-bb09-a3c0c34e94b6", "sighting--86a9e85e-6fa2-4773-b064-de5f3e21fa84", "sighting--60708b1c-e7e8-442e-af56-bcf234c3ed52", "sighting--57412f3a-7ea6-4c74-8858-1af46926b013", "sighting--a8147f0b-302a-4962-9904-37519a114730", "sighting--1e6307e5-0176-4ac7-83ff-9d7fe509c4d2", "sighting--50a85533-cd43-4bac-97f9-df05520f7d5b", "sighting--2de61979-c044-4866-b150-994dd5d5d84f", "sighting--22d985d2-ddb2-48d3-a6ea-ebba8a33e438", "sighting--edd430b0-986f-4d3d-bd90-0aafa41aa16c", "sighting--b9548a2f-f0d5-462b-859e-1223cf0dc2be", "sighting--7e080edc-9789-43c7-ab03-3ec48697faee", "sighting--09d1dd53-8277-4a91-b8ef-27a21aec7466", "sighting--27a0bcf6-574d-49f7-9975-e9e4dee032d5", "sighting--3a39419f-7f24-4870-a39d-c296c0bcb48b", "sighting--55bf9a07-2ba9-48ea-93f4-69b517343d78", "sighting--3bfc84a2-4894-42c7-ad3b-997edf98c212", "sighting--186d1767-01a3-4df4-be94-e208ed4c044e", "sighting--39635c9b-0576-408c-ab9a-ba513f06c162", "sighting--41648b46-ffe9-42a7-94e9-613daf4e9efe", "sighting--94070729-460e-4c23-8e03-1d6448a1625c", "sighting--53cf2845-c2ce-46a3-9353-dbf4492b2e4d", "sighting--bafd0aca-a4b9-42c8-8bf8-6eea3fb6f6ed", "sighting--b8abc4f7-27c3-43e7-9064-271b0bc688d0", "sighting--7b8253b9-d7ae-478b-ba79-7f4d960593fd", "sighting--7ed1a0ce-1c19-4d45-bcae-fd4d54923795", "sighting--0a000630-f46f-4641-9f3a-e9da78108663", "sighting--912576e5-d18c-4aac-899e-3fd041d6ad23", "sighting--51b0ee51-9e4c-4505-a4f8-63f80eef6698", "sighting--c919dad8-e869-4f87-a056-3f3c7dc2671f", "sighting--3847ef09-b66a-4651-bdd0-e24d384fb15c", "sighting--205a6496-4e5e-4404-b08d-11fe231370e9", "sighting--15721b27-5397-4d78-9137-eb9ee8b96122", "sighting--d36fe905-70ac-47f4-b976-023a53acf6fb", "sighting--c69b6483-975c-4089-bfd6-69ac24fbb862", "sighting--bf1e5373-ba42-43d3-a4f9-b57bebe7fdb2", "sighting--8297a0ef-251c-4a39-92fa-28b16534c727", "sighting--0a4f41ec-8729-4a0e-bad9-fceb1a128926", "sighting--8f9983d2-d140-4f55-85fc-47bbf7baf6e0", "sighting--a8e0d258-d91e-484b-adff-5541a44bdc84", "sighting--91f1cc3e-9b26-4a79-925a-7a03cc3128af", "sighting--e48e8d28-f748-4c24-831e-60a8069977b4", "sighting--d1a61648-f986-4826-92db-fe140a8e6e53", "sighting--4691aec3-bd53-41d8-b5c3-60b28291dd46", "sighting--fae8c8a7-f1d5-41b2-8b89-e9de6ef28bb1", "sighting--bb1d3130-e517-4888-93ac-98890b3acbfa", "sighting--a93fbdb9-a6b5-4043-937a-17c63ed69dd3", "sighting--e1b1b467-0c19-4efd-b3ef-087085b2c652", "sighting--d7067569-0c43-41d7-9e85-ec87064c3e0f", "sighting--d4aa229c-84ba-45bb-8677-9ef385a1966b", "sighting--79b5157b-d782-40e5-bada-c47086df6330", "sighting--e9a2f972-f53f-4f57-a784-a56bb93f4b88", "sighting--2c3cc67a-d69d-413c-b6be-37df5e839cc8", "sighting--10ac6668-19da-4a68-9500-cf8a14406ee6", "sighting--9c9c7685-978c-40e7-bed2-dd51d33307c5", "sighting--c2d7d665-886c-4b42-b1db-2cd38507d6ec", "sighting--0c8f3b29-bb4e-4596-8391-d47920652e9e", "sighting--d235f3f1-1f38-4dce-8a38-74ca58d44260", "sighting--ffe30732-5f27-4ee1-8712-b6d965febf4c", "sighting--26bd3255-99e5-49f7-9565-e40f9934bc24", "sighting--b1922a40-93e6-4bf3-8216-f932c411f1c6", "sighting--b52d9988-b0ec-480f-b4ef-e3a2550628c9", "sighting--7e8d6a07-df09-480d-9870-1bb3057b66cd", "sighting--71d6bf97-7432-463b-a58d-04d9d2530e37", "sighting--5c11edf8-e49b-45af-b5d6-34b1da44514d", "sighting--baac78ee-9624-4dc8-b212-6e3d276a109e", "sighting--28ef7e8b-e0d4-4d0a-8d40-236a4d7b571e", "sighting--71ec5764-06a9-4376-b124-1eaf01fd0bf8", "sighting--6ef44337-af95-4780-a96b-4b78e413479b", "sighting--c0a98950-4c6f-4a6e-bafc-61edc1228d49", "sighting--9717b7e9-c479-4bed-9381-f744a5182ce9", "sighting--6ba6de28-d47c-4dd4-9002-15340ce4acc9", "sighting--4d5d6505-b2d5-40b8-bdb9-1bb03619b7f4", "sighting--f194d982-47fa-41c1-9e2e-0dee93ec3a7c", "sighting--130cf209-5c2f-4d51-a176-c2c3381a90d5", "sighting--3692d5a2-8885-46f2-9d29-f147a0d405b7", "sighting--c1f9fc01-3ff1-4879-93b0-a120814bebfe", "sighting--61358201-4deb-42eb-bebf-ac5f68946e8b", "sighting--2e8b7543-759a-4f4d-b36f-45feec2c7f68", "sighting--ada7bb8f-7a39-48f7-9953-31b20f0ab142", "sighting--2048dadb-ced0-4c8a-99f1-47e9d13011fb", "sighting--32bbd938-079e-4cc6-9796-5a1713bca75c", "sighting--1b7c0ac1-3dc0-4d0c-874f-e1d7f17a37aa", "sighting--a54a97d5-3e2b-45f5-836e-c4ace3550fdf", "sighting--662a9033-b9d7-48fa-a97d-23051e0f8d02", "sighting--f18697a3-4ae4-4615-8bfa-9a47d2103f2b", "sighting--497bc8c5-aa2f-405d-b72f-1271f50105ea", "sighting--d6e2a55c-76f1-4523-bd44-9a0e528365ed", "sighting--8ba53277-1a60-4bee-a53d-9eb39d5ca0c0", "sighting--6a1081f6-edb4-43f3-9714-e79fb792e464", "sighting--1b847a32-e89d-4653-8cd7-fffa75614cc2", "sighting--1b7792b2-723a-450e-8c0c-a94eaa9a250f", "sighting--a5fd63e8-89b7-4c47-a4cd-f11a55524ff6", "sighting--1e2c12d0-6419-488c-a5bb-1cd257f08139", "sighting--510c9a43-821b-4186-9e09-334928a07b67", "sighting--c69ed906-f62b-44c0-ad08-45c1ef434a2c", "sighting--76ecf917-da9e-46e8-826c-842da63da32a", "sighting--0f66809a-6d8a-4059-9d97-8a79ca55b24f", "sighting--db5fcf06-a015-4cb6-b2d9-b0571566d2f4", "sighting--edbabb1c-0d16-4d6e-b0be-6681118f9beb", "sighting--bf4c0940-fdc0-4907-bc1c-7fb46e2e003a", "sighting--8da3924a-74c4-43a3-9a26-c61eecf0428e", "sighting--1a2f3a57-afc5-4ec1-9cc6-621b70d43c81", "sighting--c0f767c1-58ad-4853-83e3-0cdf3a10e1be", "sighting--4fd3164f-7f92-4f31-9e1d-e0f700468595", "sighting--424e4d3c-1467-45e2-aefa-a2271b71b11f", "sighting--72d9e9e6-d973-4249-b0e7-c846b5b903d9", "sighting--1efa1d5d-4c33-4ec9-a0dd-c99402001e0c", "sighting--dfaaec8c-834f-4651-b10a-75fec0104728", "sighting--a2780281-1486-41ad-8295-40063d72b8a1", "sighting--b5b02c94-f91a-4917-8716-bbeddc49a577", "sighting--5a5d5bcf-8b86-4972-b4b9-e41ed1e19f1f", "sighting--14bfb5e5-0ccd-4222-8021-503bdd90cb60", "sighting--c68226b4-4d53-4005-b153-a3801430aa58", "sighting--9a7351e3-3120-452e-9ab2-9890c982fcc0", "sighting--84d9ff97-9fd0-4526-ba40-415fc72d4493", "sighting--cef90b05-5553-4482-8bb3-a8b76d0b3bf5", "sighting--4c17e6c8-c4f9-4207-9806-c91bf248cb5b", "sighting--12474b8b-1c46-4d46-ab3e-9eb6d2f548c2", "sighting--2917793a-9980-467c-be87-aa5d3854ef0a", "sighting--f7cc4996-fef1-4da2-9fab-e6831672e0ec", "sighting--2ea37b57-4d09-44f8-b885-e63dc5ff5ab8", "sighting--0cb7a344-b4b7-4fd1-910b-d193901cfc06", "sighting--0dafe581-a00c-446b-90e3-3c3facde787f", "sighting--b395c37c-57c3-42c0-933e-21ba2ff0c9a3", "sighting--7b4355c9-0b6c-4064-9ba7-9e7525fa7099", "sighting--c8650224-d2b0-43f1-8d6f-e5152eff2e4e", "sighting--8785fc86-717d-4d28-a9d9-4529062f7387", "sighting--521ec225-d2fb-44d9-bffc-9cea9a01bef5", "sighting--727c1a01-fc27-4147-bed7-6a9a04dcf6b4", "sighting--54058320-b151-4a31-857e-0f07db940ab0", "sighting--d7afb3ed-d73e-4098-bc44-ea085638b14b", "sighting--037436c5-4ac6-416e-8f78-f7aeb9676fc8", "sighting--18ee9744-9ec7-4bdd-8097-54ff9cf078ec", "sighting--2e40b857-d761-4d6c-a5cf-e0eff9978bee", "sighting--5ef5bdd3-7bbc-4670-83b5-b7599dec0d39", "sighting--af5e4dca-6652-40ae-9d97-b2f1e8329718", "sighting--0fd03e37-3719-4d51-8d8b-79b6d02d86da", "sighting--648db06b-bea5-4623-9ea6-7f48bfcf823b", "sighting--293ec34a-7cd2-4693-b8f3-eebf97c57cfe", "sighting--e5bf4496-128d-4588-89aa-cc06ded5596f", "sighting--721b7ed8-8867-42fa-be83-803a7f84928f", "sighting--b6f91c27-ad6f-415b-bbb1-8169026e2fa2", "sighting--c4c4b087-2934-4bb7-973a-0cf53a41fee4", "sighting--e0b99adb-ef51-4245-a3f5-5382f9329327", "sighting--29d7fe05-fde9-4c64-ae70-ad2325cf52a8", "sighting--4948312c-2926-4fe7-a845-860de3cc4229", "sighting--24878f86-0e9a-412b-bb0d-eef4dbe84456", "sighting--bda1875e-b47f-42c4-a8dc-e734608b1c83", "sighting--c65a9da4-4ff1-45f9-a3c0-b2d007da64cd", "sighting--ebe6c7aa-7c62-41ff-af91-8cdd8ba79ed6", "sighting--73bd467c-4f66-4c34-8e43-e990dc9d116c", "sighting--91775f09-24b4-4bd6-8519-a8fc2cbb507c", "sighting--4c0464b0-44c5-4e92-9c59-78fb6be2891e", "sighting--aa3cd5e4-d8ec-4027-92ee-29f19e15725c", "sighting--3c929bfd-c5a1-45d7-96e0-e56aff2e702d", "sighting--e61974df-ee91-4135-b7de-da7d7d33bb10", "sighting--f5294acb-85e3-4604-b763-7fd31210d03d", "sighting--b8c10173-3e42-4097-855e-69fcd7ee5a71", "sighting--6bfef809-103b-4408-8d53-13b9f2df2e95", "sighting--1a739c8c-d792-49a5-a145-538463488807", "sighting--a2b18287-c6f6-45ff-aed8-f4de6c9d6198", "sighting--cf2120b2-c7e1-4cd8-8ced-09dfa17ee04e", "sighting--2e48bbb2-49b4-4e7b-bb6f-a03e21f33fdf", "sighting--966bb47e-2003-4e32-a812-0bc411fd1622", "sighting--22a63ba1-9769-464e-be8c-496f98529338", "sighting--9be73d89-3c8b-4ef7-9dc0-a929d1a18deb", "sighting--0d6aeb50-f8b7-432f-9aff-c0be07e30929", "sighting--8f725dec-df4e-4f9e-945f-beac8eb05eed", "sighting--7856db18-2414-43c5-9989-15da1e52e2b8", "sighting--fbac1286-1d71-411b-a4e6-47b30e95a76b", "sighting--baf04ffe-e8e6-4af7-b543-2b4249bf38c5", "sighting--7ce8627a-0881-4f08-9130-cf336144323a", "sighting--7c0e3add-bc1a-41fa-8588-2aaa14949e58", "sighting--7e392f94-e72f-419d-bcae-768d1d7bba0f", "sighting--54366a66-c1f2-49c9-a834-349b738f2815", "sighting--cf4110e8-4e2a-4884-ae41-04d4cb267201", "sighting--b75cf0ff-a12e-41bf-b6bb-f4562ac70694", "sighting--c07054ea-e660-4070-901e-2a7d5b5469ae", "sighting--00e23d76-8d85-4e01-b7fb-3f29cbed2391", "sighting--5e41d04f-6f36-4d8f-9ebd-acc9b57c9837", "sighting--f49d27cb-5b16-4170-bda9-49ca8e8a400d", "sighting--087d5ad8-b5e3-4ff7-82c2-480e2fa4a82d", "sighting--87e5d03d-2818-4f8d-83a6-2a5901a9c834", "sighting--dfa590a3-f9fd-4b5e-8060-438516af031b", "sighting--f1c931c5-23aa-4fab-973d-1f28fd2d900f", "sighting--2c170d86-4354-4c88-8aff-6653e2fb4aa4", "sighting--13222f8f-12e8-40f7-8c28-975324b8a6a9", "sighting--10377a38-bf80-46f8-b023-dc97b3266acf", "sighting--fa81a688-94f6-41d7-a4a7-38ad13a89cf0", "sighting--a41c5a36-f0d5-4e0e-b4d5-4819b8a65d6d", "sighting--8be464be-ab8f-4618-9167-746ac1a9b411", "sighting--35da4f5f-9910-448c-8a59-4f54d707873e", "sighting--cced7172-bf00-4107-9d70-43cf8d5f8df2", "sighting--3e08273a-157b-4c00-910d-d7eb04f6013a", "sighting--27939a47-0c2c-440f-a87b-91c374570850", "sighting--97d27e10-00be-4c8a-8186-a8180d8eea11", "sighting--516a26d0-2699-4fd3-9e3e-c7eb3b0e377d", "sighting--5b4b3a18-cbf7-4716-9a14-9e40ebb856d7", "sighting--df23b9ea-aadc-4c5b-9a55-5f9c22912655", "sighting--793377cd-fe77-4173-ab95-5cf3bb1ed0d4", "sighting--3fa7bba3-e176-49b5-b0a7-8a943020c8a2", "sighting--c20659c0-3c01-49d2-bb5a-5f6cebd78b93", "sighting--a0c0ca1b-715e-4b3d-95f6-d6f14ca31259", "sighting--13e3afe7-e976-4555-bffa-a34c63d8d762", "sighting--aacfc7c6-4303-43f8-9441-8b088ed28c17", "sighting--6f760137-d67c-4394-8c43-71b39bcc963c", "sighting--0db389e4-0796-478f-a0eb-2c5dd4c02116", "sighting--94035473-dfed-4569-a2f6-96065d3ee130", "sighting--69ab7e00-8c2d-4ecc-ad3d-0e2670ff5b91", "sighting--e32f0fe6-cf2d-489c-ab82-59792e27aa49", "sighting--dca0814e-b64d-47b2-be7b-9faadb88fcfc", "sighting--9d139dd2-e084-42d0-9952-e15923cb0ac0", "sighting--1371726a-251f-4bec-8af0-309c32c7b710", "sighting--053b0fac-fece-4f26-84ff-46856ec73f00", "sighting--201c9f0e-355d-4c68-94fb-5a6502d0325e", "sighting--7e2d71c9-0266-4339-9182-3430465fee56", "sighting--d246bbc8-3c7a-4ac8-913c-8f74a57207bf", "sighting--5d6e799d-7b75-477c-9161-0d9ca949a303", "sighting--da5723db-1dbb-41fc-a680-439e7129dd0d", "sighting--a6bfabbe-98c6-4338-a014-52c26cde325d", "sighting--38ae9897-2288-4c10-9023-b00a3656021c", "sighting--09edc7d0-b857-4758-ba82-067d6f5c822c", "sighting--393361de-d390-47e7-a795-cf3413bc308f", "sighting--bcad726b-1f84-4fd8-a99a-a961ccd3ec3e", "sighting--d3647545-f1e0-4d63-9095-f2c2b8b9f740", "sighting--ab9ce4d6-4c57-4f3f-9c6e-00e702288591", "sighting--6cbd6e3d-9886-400b-9835-556870d57ff7", "sighting--eb0b35f2-2904-4232-92c4-3c02b40f24e6", "sighting--eaf546fd-cfaa-4335-8f4b-8a0cf853be78", "sighting--410412cd-1903-4f4a-baaa-9acbe8d1b037", "sighting--8dec5008-9380-40e3-ae68-9687973bb8c7", "sighting--b883ed94-d731-4f33-b2a0-c7d27e5630fd", "sighting--66c7d615-5f85-4109-8dc2-6486364efb74", "sighting--4cc76dd2-a94e-46fc-b66b-11b11ec49535", "sighting--1f828058-1413-4c0b-93d6-7ac7fa9491cd", "sighting--112e0016-1c28-465b-a9bc-2a78c5e76a98", "sighting--bf01f04b-047e-483e-a056-86a42782447a", "sighting--a6e8d2b4-8324-4b42-8d2b-b5c866271d58", "sighting--92b7e48d-7215-4001-9c01-fc49517a574b", "sighting--d32c8f22-3613-4d35-8e50-28a1304753d6", "sighting--f4608397-227b-44c3-8be4-7d9518e844e5", "sighting--8c5017d4-cb72-40e1-a90c-2b53de369656", "sighting--0c4615e0-0b7e-43ba-9a4a-30e5b263514d", "sighting--b36f839e-d44a-4638-b1ce-95b48da4146a", "sighting--e15eb78a-8d11-417e-bcd8-cd783ccf2464", "sighting--41071fd3-6e02-4452-804a-8cbb1fc7f7e4", "sighting--4b206990-8276-4943-8f76-9c80164b6442", "sighting--4783adce-611d-4fa0-a9d5-6b2e9d19016d", "sighting--27e4220f-0924-4f7e-96f8-8cc427db475e", "sighting--df7b308e-50cb-4d2f-8f1c-aa9423bb7eef", "sighting--ede34d77-c66d-4415-a83b-43d85bf10327", "sighting--be670dab-d81c-44c0-bb5a-f7f879f738d1", "sighting--1c365f6b-d0dd-431f-9774-0b269de267fb", "sighting--1f88d131-5c31-47d9-b362-251073bb597e", "sighting--0aaec5ca-70d7-4619-889c-12379b5592c2", "sighting--3b47f9c9-966a-4caa-b3ff-f5fe680ff2b4", "sighting--1a08055c-3b41-4968-905c-349983b3c251", "sighting--31ba1abc-6f59-4133-a401-01398834a9ac", "sighting--a5cd6f6d-2879-434c-afca-e4779d92b90d", "sighting--ad682ea3-5602-42b6-8872-a170a26fe69a", "sighting--dade8383-7bff-49a2-a4b1-b85847055a66", "sighting--71795c5b-ac9f-4d89-8829-8846a4449d0f", "sighting--4eba1f2f-7570-4454-a7f8-0cefb239503f", "sighting--afd69fa1-d07c-4e41-bd5d-c3d42991877a", "sighting--7f6c31cd-a234-4181-87b6-c669dc6b27d7", "sighting--a4c0cdf3-4e34-4b4e-a20d-c26ca2a28cee", "sighting--eca4d650-be9a-4922-bb26-6493b897067f", "sighting--90d257b6-5e52-482a-9ed2-fa238c36b014", "sighting--48a764c4-b83d-4f7e-9bb8-901977b16ea4", "sighting--0a328f7c-1eb5-43b4-bbb3-3220a2251a41", "sighting--0aec4386-390c-44f2-8677-065b2d8b9e45", "sighting--5a6c2508-c3bc-40bd-bdaa-87a7304544d7", "sighting--8f391ba6-7dac-4437-87db-3f31ac6c1625", "sighting--04488ae3-ea28-4cb7-b093-569fac15a197", "sighting--4032789a-7be7-4d15-92ec-083adde2532f", "sighting--d7cce39c-47ae-43bc-b3bd-b8814c29ad18", "sighting--81e29c87-22c8-4973-b4a9-5f8652a9d553", "sighting--220858a8-45c1-4f2d-a028-a2907846301c", "sighting--20c22454-b9da-451b-82c4-d87087f2bee9", "sighting--bac23eef-f05c-4197-b99a-4d58dab3a183", "sighting--5dc7867c-fcd9-4aae-ad3a-32b3914b4267", "sighting--3ed4e4f5-65a7-4030-9690-95a716eae445", "sighting--c7df5977-69c7-4d72-a02f-c8451145a6f2", "sighting--6b0e1197-4da9-4b64-ba59-e5c75628014a", "sighting--205c766e-c27d-4cf0-9851-d95511ad072e", "sighting--a81ab3e3-a87c-4213-995d-b6074944a881", "sighting--1a383b84-b748-423e-9608-79adc22c64a0", "sighting--74cf2262-a84a-4af8-aa42-a152509f76ef", "sighting--5c7e2f87-efeb-4bf4-a3af-5349dca6ad97", "sighting--98afc8a1-f2a2-44c9-b79a-d7db1e7da03e", "sighting--b7f67509-6a56-4067-b424-1aa7a43e4050", "sighting--7d99959e-da50-4341-bd01-77b4bbfcaec8", "sighting--a62fc9e9-5fdf-4a5a-aa91-2329c4fac8bf", "sighting--c93be09c-afca-4b9f-8163-a07e81d7696c", "sighting--09ee4a79-602f-44da-a551-54cb1e4a7fb9", "sighting--6331e10d-7f6b-46b5-9ab8-2dfaaa9d70b3", "sighting--3cea7620-4ae6-44fa-85d5-3c1516b0814d", "sighting--bd4adb91-f339-4cde-88d5-d8ef0a95bab8", "sighting--bd04ee9f-a309-4944-9bd3-7f34f4d76d8a", "sighting--b12489e0-95e8-4b20-a11f-010b7b68e70c", "sighting--f12dc8a3-8166-4504-8abf-8976e6750bb6", "sighting--3f7ef8c2-710d-4ac4-a99b-9cd0dde9e22c", "sighting--28ba8c67-aace-4203-805f-d46fcf91d40e", "sighting--83f8fa4b-b518-4b75-ba26-9ee7677fb9a8", "sighting--926a7eec-ed0f-4eb8-8b8a-a33469cb573e", "sighting--75ce8c2a-8183-4d77-bac4-cc860758ac4c", "sighting--af43bcc8-dbe0-40e5-8c0d-a3939a77b2da", "sighting--c84fa739-6019-4946-8106-bf294ebff579", "sighting--303a261e-5c31-40ee-9f64-2c175e184fff", "sighting--0c687394-7732-4c2b-ad41-8b4cbbfabafb", "sighting--55603e79-93bc-4ce2-a7ce-657f9f846bf3", "sighting--b89aad39-996a-47e8-8b15-404aa8e87860", "sighting--0a44f9a3-7056-4ae1-a040-b633b5e6f2cf", "sighting--b6bf88df-ce7e-4ecc-bf05-dc2ad329d06f", "sighting--5448a17c-bf99-4244-a165-61f0e14560f9", "sighting--802a1b28-34f8-42b9-be7e-19015dbba710", "sighting--330f4f5c-fde2-4e49-8d25-5261fcc2d69d", "sighting--46568751-fcda-4cd0-ad11-cf4b35ca60e6", "sighting--9502e85e-8615-4a63-b746-874a1f250e5c", "sighting--9f9dfe06-7b59-4a66-a057-0f6dc580cb2d", "sighting--780722cf-cdd9-479e-a8cb-b3bb41ae5e5d", "sighting--ed66838c-c22f-4bc9-8062-4042fb741046", "sighting--4b518623-8e7b-485a-96bb-9eb789673a21", "sighting--13ce0fbe-197b-4c8a-bcd3-6ff083c9685f", "sighting--23fe68d8-4811-40d6-bb17-2adbdc0b5fc1", "sighting--927bd7fc-2a68-4dba-8cb6-0eed3ca39f02", "sighting--ae7fb773-43f5-4584-ae80-737e334de35f", "sighting--a4316f94-8079-4ce4-82a4-ccfa72ecaaf0", "sighting--8f4a34ad-2c23-41a6-9f1d-9f81ccc08b87", "sighting--e2679275-562f-421d-9ef5-b041a723d5e4", "sighting--bfecdfb4-8803-4c12-8281-ba06e93ed407", "sighting--608417cc-f3c7-44d4-8355-9ede7c1d2112", "sighting--efbf0551-354d-4bdd-8a28-644f7e5f5ac2", "sighting--66316238-f899-4155-861e-9836754f3d8f", "sighting--71f871cb-d3a2-4383-b0c1-90532b48ce5b", "sighting--4b70a762-0fd8-4816-9a15-0746e9f7b41e", "sighting--e0da5129-3289-4ac5-96c9-feb29dd2dccd", "sighting--a90a6978-c09b-4dea-97f2-6fa90672e938", "sighting--b2237049-85f3-4505-aebb-0bfebe297f4a", "sighting--40726c97-0675-4256-be7e-5c5ed1887424", "sighting--911db546-34a6-4b41-8f25-65628ce8ebe8", "sighting--6cfdf733-2159-45be-8202-c00683c92abd", "sighting--9353a0cd-45bf-45a9-b5d7-ec986278a5d5", "sighting--94932d7b-6cd1-40cc-b679-7a316743d7fc", "sighting--d9513393-54b6-4472-951d-9c8509831eff", "sighting--58e8fe94-6093-4ef3-a9de-7c9129d4bd40", "sighting--51205117-2e31-4126-a1c0-c1fd6a82c9d5", "sighting--5234d1ea-5502-451b-a41c-8a8fd13b6b66", "sighting--72eb86d1-6212-47da-ab25-9810be4466fb", "sighting--76e1cbbe-0d68-4bc8-97ac-a95f1fc27832", "sighting--55943b00-f817-448e-a3c2-0cb4af6d74ea", "sighting--1b745345-8ecc-4c19-85b9-ccce4037ed8c", "sighting--23235170-8051-429c-a5e4-c78e374aa99e", "sighting--48c6ecda-cda8-4693-84de-edcbc777556f", "sighting--11aebb66-2149-410b-b981-32938c0cb83b", "sighting--eafbc56b-e968-43b6-9638-647afb3755f3", "sighting--5caa4c27-4d58-4cdd-a25b-93fdac4385c4", "sighting--faf6b1b1-ae47-4cdd-95f2-677327d1d7d5", "sighting--cb7367a6-d634-42a4-ac1b-8ffdb0d7b1c8", "sighting--a0408e97-0480-4c3c-9e80-7399015febc9", "sighting--ea1b43cf-57bd-41fa-b11c-fc39848a5d54", "sighting--1713f994-a1ca-4ebe-9274-f2a018dad421", "sighting--6687848a-41f1-466a-ad32-7bb983fe731f", "sighting--aa2ffac2-6f6b-4778-b0bd-b8f9d6b59ffc", "sighting--833115a1-b9db-4339-8944-f2fc0387f20b", "sighting--3e091a1a-1a23-4841-8e54-b3bfa3180a40", "sighting--dda864b7-9965-49f5-9b09-89977ddb46f3", "sighting--8a93b222-82a8-4ec9-93dc-3ba1d6c5b6c4", "sighting--f1d13b73-dfbe-4171-99f6-b4aa7b4d24f7", "sighting--f61e7676-c262-4c42-b5e3-351fb6965d3b", "sighting--4a6444c9-37dd-4ee2-8cda-6fb24f09f281", "sighting--02356d79-2e64-4685-8676-503d74b42aeb", "sighting--6c469c2f-ca25-4798-b9f6-5f27b5606ec5", "sighting--10010f61-83f3-4d18-91d0-efacbdb621e3", "sighting--e9ff3cc7-1c82-4fdc-a808-289f0fe1f76c", "sighting--d6a57764-a48f-4fe9-bb11-22f38d6a8a84", "sighting--ad953eaf-71cf-4ee7-8b39-2d88dcc54817", "sighting--16011035-5fae-4787-8a0d-ccda26a6f209", "sighting--b86f047d-a217-4190-b145-d4867383c279", "sighting--f84391ab-0f58-441d-9fe0-9b233063548c", "sighting--f0a2c520-f146-47fa-83a8-c79ff2fe8f2e", "sighting--5126b2ba-56eb-4357-bd48-56c7655e095d", "sighting--5394c6b7-480f-4f26-82f7-2eff38f0ce54", "sighting--b2050a4a-3f23-4e79-8992-b1d61821acfa", "sighting--71ebac89-27df-48ae-b976-80708bbe219e", "sighting--ffd25c51-e421-48f8-b9cd-f613ff2afe0b", "sighting--a94fa285-8ab3-4e6e-8ba4-cf1ea5d58ac9", "sighting--75c35dbe-887c-4042-aa78-47bd2a168ed5", "sighting--73a2c6f1-e72f-492f-9409-87e70297d0f0", "sighting--46fe8246-8743-4efd-b580-b0cd0bb07c34", "sighting--5dc4b1f0-c8e9-44a4-bb44-79cbae75779a", "sighting--cada6632-691e-4dd3-8e64-02c4601b568e", "sighting--c2949adb-dbce-4137-a9e4-1fd5e417e5f0", "sighting--f1bc209e-d566-4a9e-b337-59a341eec0e3", "sighting--7a02ec11-06e4-4963-8468-2b35a0776f85", "sighting--55fa9804-7d64-4f26-9cac-70c0b1b2f797", "sighting--81b4ca1f-91d4-4809-b1a9-d3bde03d1474", "sighting--fee1fe77-9d05-40d0-8018-42e4df317438", "sighting--2d94e445-8693-42ef-bcc3-62f75e573685", "sighting--c12c1dc4-d014-4878-83e2-f660f31206e2", "sighting--d30b0895-f476-480b-9549-f2968ada559a", "sighting--cf8191a3-6dd2-400c-aef2-abd6085c9dbb", "sighting--ce22ab26-53a9-4add-97b1-4a005c302024", "sighting--ab406644-a613-4dd1-aa9a-e82cc0fccf23", "sighting--a07922a1-cda7-48dd-a636-df353402e962", "sighting--a1c0760f-691e-4802-b110-62970d1ecd4d", "sighting--d7518215-9a91-4a01-8325-ddbc4ca61c9d", "sighting--20089678-6ccc-4dec-8dab-d5fca7dfeed7", "sighting--0b5eaa13-514a-4603-8834-2e750cce3492", "sighting--d8de2cea-2954-4ae9-a6bc-594333e9af3a", "sighting--30684c38-3a62-4c74-b85d-c3d41557aeec", "sighting--b6e5bb6b-18c9-4ff2-a0a2-d706efdaa757", "sighting--df362ec2-7901-48cc-bf0e-cc36303d6ef3", "sighting--53f3f624-d684-43a3-86ae-e37e36d92e7d", "sighting--6cd0190e-eeef-4fc7-8d70-993fdc215da7", "sighting--34deeac3-71a2-49b2-b79d-568ee036e73b", "sighting--35d99df0-6fd8-4ca4-ae27-1f097f96690b", "sighting--aa283e0f-364e-49a9-8b6f-8e87a8f50ab3", "sighting--df3cdca7-21e7-4091-8638-4c0790575f7c", "sighting--f06f70d1-a9c9-4c53-86ed-83ea2c81918e", "sighting--82e54a78-1a2d-420d-9506-3059ba717ec0", "sighting--a6cfb86c-0079-408f-a1a5-36d0ab40940c", "sighting--3d45aba9-207c-4379-94f3-2969a98d38f6", "sighting--b75f9ab5-7392-4f5c-b72a-4a24c42c00d6", "sighting--35c1e600-0622-47ef-9374-f0cb3e8b303d", "sighting--9a314d77-b3e8-4ebe-92f0-678cb1676dd0", "sighting--2d34049e-d5ba-4c75-8fa6-4008ac9e12be", "sighting--7994d5d7-9438-464b-9ca2-235d8f5597f8", "sighting--d6c1197e-f72b-42fa-ac95-cad6faefbe2b", "sighting--57c96303-983c-4837-a189-db403dd9c4ac", "sighting--ca05d0ff-b3a7-460c-93ed-7ee1c16cdad4", "sighting--3dc5674b-599e-4561-8bb0-79a5168810a1", "sighting--3fd7188f-cce9-4232-b94a-70bb9cc19cc1", "sighting--e827b718-8494-49d2-adf3-36ec1e83ff17", "sighting--7cdeccf5-fc2c-4842-ae81-3f70a9c44712", "sighting--d1cb744f-70ac-4d39-bf62-4a339d3d89eb", "sighting--1e6a9dfd-04f2-4110-81b4-82a3f541f29d", "sighting--4d6b4835-b7e7-4558-8c72-e3c345bd234c", "sighting--fff9b80c-8e3c-40ff-a620-e840a832cfa3", "sighting--2e73cd3d-6689-456c-a392-92bf88641fa4", "sighting--3c0bd8f5-6568-4806-8265-01e9faf3c17a", "sighting--f9e9d65c-5bd6-4113-b301-55e465f90aa3", "sighting--1326455c-dd0a-49ce-9e5a-cc760e91294a", "sighting--1b7c73f5-eeaa-472d-9f5d-e88a7c986c78", "sighting--fa2782e5-1c0e-43c4-a6a7-0ab4413b0434"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-06T11:00:01.960Z", "modified": "2026-10-06T11:00:01.960Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}